## 4 Case Study: Analysis of a Device
### Comparative Analysis and Discussions  
After completing the execution of the proposed methodology in the case study, the results will be compared to related works. A discussion of the proposed methodology concerning its efficiency and limitations will also be presented. The methodology proposed in this work expands the possibilities of extracting data from mobile devices and can be used in devices with different characteristics. The acquisition capabilities in relation to the characteristics presented by the devices are as follows:  
* **Capability 1 (C1)**: Data acquisition from devices that have an enabled lock screen mechanism;
* **Capability 2 (C2)**: Data acquisition from devices with FDE disk encryption;
* **Capability 3 (C3)**: Data acquisition from devices with FBE disk encryption;
* **Capability 4 (C4)**: Data acquisition from devices with OS up to Version 9;
* **Capability 5 (C5)**: Data acquisition from devices with eMMC and eMCP memory types;
* **Capability 6 (C6)**: Data acquisition regardless of SoC manufacturer;
* **Capability 7 (C7)**: Data acquisition from devices with F2 FS and EXT4 file systems;
* **Capability 8 (C8)**:Data acquisition from physical devices. Table 3 shows the comparison between the results achieved using the proposed methodology and the results obtained by the tools and methodologies presented in the related works. Concerning the data acquisition from mobile devices, the capabilities were synthesized to ease the visualization of what is common to each referenced work. By analyzing the related works, it appears that there is a great effort to improve tools, techniques, and methodologies in favor of data acquisition for forensic analysis. This effort is due to the highest difficulty to overcome or circumvent the security mechanisms that protect the devices data against unauthorized access. It is observed that such mechanisms also hamper law enforcement, as specialists encounter the barriers mentioned above, even when some legal devices and mechanisms support allow the analyst to access such data. Figure 18: Recovered files. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Proposed**} & \multirow{2}{*}{[20]} & \multirow{2}{*}{[7]} & \multirow{2}{*}{[34]} & \multirow{2}{*}{[44]} & \multirow{2}{*}{[43]} & \multirow{2}{*}{[9]} & \multirow{2}{*}{[45]} & \multirow{2}{*}{[46]} & \multirow{2}{*}{[47]} & \multirow{2}{*}{[48]} & \multirow{2}{*}{[49]} \\  & & & & & & & & & & & & & & & \\ \hline
**C1** & X & X & X & X & X & - & - & X & - & X & - & - \\
**C2** & X & - & - & X & X & - & X & - & - & - & - & - \\
**C3** & X & - & - & X & X & - & - & - & - & - & - & - \\
**C4** & X & - & - & - & - & - & - & - & - & - & - & - \\
**C5** & X & - & X & X & X & X & X & X & X & X & X & X & X \\
**C6** & X & - & - & - & - & X & X & X & X & X & X & X \\
**C7** & X & X & X & X & X & - & X & X & X & X & X & X \\
**C8** & X & X & X & X & X & X & X & X & X & X & - & X \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Capabilities of both the proposed methodology and the related works. Among the mechanisms available on all smartphones running the Android OS, the lock screen, when activated, prevents access to the devices data and functionalities. It also prevents communication via the USB port, as the USB debugging mode is disabled by default. Although the forensic tools on the market promise to remove or bypass the lock screen on the overwhelming majority of smartphone models running the Android OS, this does not work in practice. In a wide range of models, the use of tools from various manufacturers, such as UFED, XRY, AXIOM, among others, is ineffective in extracting data when the lock screen is activated. An example is the model SM-A105 and its variants, whose commercial name is Galaxy A10. The methodology proposed in the case study of this work used that device, which is sold globally, runs Android OS version 9 (Pie), and was the second best-selling smartphone in the world in the third quarter of 2019 [58].