## 2 Methodology  
In this section, the methodology followed during the development of Chidroid is described. The test and validation cycles (Figure 1) were as follows: (i) Chidroid development and versioning updates and the creation of the Android Package Kit (APK) file, (ii) the definition of the default configuration files and permissions granted required by the APK, (iii) enabling Chidroid to execute shell commands defined by the configuration, (iv) the definition of the commands that generate and create Android logs, (v) the creation of data type patterns, regular expressions, and corresponding log sources, and finally, (vi) the support of bash shell piped commands to be executed by Chidroid. These stages were followed sequentially, and multiple iterations were performed to provide better versions of the Chidroid to support the required functionalities. Figure 1 explains the structured methodology to ensure that the application met the functional requirements and performed as expected. The first step of the methodology (Figure 1) comprises the development of functional requirements, including log retrieval and log distribution. The test and validation steps were carried out to ensure correctness. Once the application was functional, the next step was to define the permissions needed by Chidroid and define the relevant files that should be included in the APK, for example the permissions that Chidroid needs to have to retrieve logs and configuration files that must be included in the APK to enable log collection and shipping by default. The Chidroid system was derived from a previous iteration of a software application known as Metago, which was developed by the PDMFC organisation. The encoding protocols and formatting techniques utilised in Metago were retained in the development of Chidroid, with additional features incorporated to facilitate the collection and analysis of the log data from Android devices. Consequently, it may include different configuration options employing the encoding scheme characteristic of Metago, or the collected logs may be distributed in the raw format (Metago Raw). Figure 1: Methodology followed to develop, validate, and upgrade Chidroid. The present study advanced this by incorporating the functionality of executing user-defined shell commands and specifying their usage in the configuration file. The implementation of the shell command execution enabled the collection and tracking of Android logs through the utilisation of relevant tools such as Logcat, Package Manager, and AppOpsManager ([[https://developer.android.com/reference/android/app/AppOpsManager](https://developer.android.com/reference/android/app/AppOpsManager)]([https://developer.android.com/reference/android/app/AppOpsManager](https://developer.android.com/reference/android/app/AppOpsManager)), accessed 20 February 2023). The initial verification of the data collection accuracy was conducted, followed by the parsing of logs into a structured format, the creation of data type patterns, and the definition of regular expressions to extract specific fields. The implementation of shell pipe commands in Chidroid enabled the execution of multiple commands for searching and filtering logs prior to collection and distribution. A methodological validation was carried out at each step of the implementation process, utilising the following devices for testing purposes:  
* Android smartphones and tablets were used for the validation steps (Android Version 6 to Version 12). * Android IoT devices or gateways, such as routers and hubs for smart healthcare and IoMT devices, such as medical sensors and healthcare systems (the exact models are confidential due to licence agreements) (e.g., smart glasses, smartwatches, medical implants). The individual testing of the devices was carried out to enhance compatibility and verify the functionalities of Chidroid. During the validation tests, no medical or healthcare data were collected.