# Exploratory Study on Kali NetHunter Lite: A Digital Forensics Approach
## 1 Introduction  
The dependency on mobile devices, particularly smartphones, has increased dramatically over the last decade. According to [1], the number of mobile devices will increase from 14.91 billion in 2021 to 18.22 billion in 2025. With so many units on the market, the diversity of devices and operating systems (OSs) allows users to choose what is most appropriate for their needs. Of all the different OSs, Android is the most common, with approximately 70% of mobile devices, followed by iOS with around 28% [2]. Android OS and its variations are installed on approximately 73% of mobile devices worldwide [3]. Over the years, Android has evolved and branched into many different iterations, becoming the operating system for various smartphone and mobile phone manufacturers. Additionally, technology advancements have allowed smartphones to have the processing power to the extent of a personal computer or a laptop, ultimately aiding the user but also allowing malicious users to gain access to the user's data through another source. With that much processing power, hackers using mobile devices can exploit users by mimicking commonly used applications and gaining access to location, photos, and other information. When devices used in those crimes are captured, they create a problem for mobile forensic investigators due to their modified OS. On top of the modified OSs and frequent updates, custom applications add another layer of difficulty to the process. For example, one of the most widely used penetration testing platforms, Kali Linux [4], is available on mobile devices under the name Kali NetHunter. Kali NetHunter [5] is an open-source Android platform created for penetration testers who need a portable version of Kali Linux without sacrificing many features. Over the years, Kali NetHunter has developed three different versions, NetHunter Rootless, NetHunter Lite, and NetHunter [5]. The Lite version has almost all the capabilities as the full version (NetHunter), except for WiFi Injections and HID Attacks [5]. Only requiring the device to be rooted (i.e., providing privileged user access), the Lite version of NetHunter provides the most flexibility without looking for a specific device that can support the full version. Despite the actual intention of the tool and its capabilities, Kali NetHunter can also be used for malicious purposes. This is a concern for digital forensics, particularly mobile forensic investigators, as there is little analysis performed on the application. As seen in recent studies [6, 7, 8, 9, 10], it is not unusual to have a comprehensive investigative study on mobile operating systems or applications. Regardless of the capabilities and potential of the Kali NetHunter platform, there is a lack of publicly available research on the topic. The review of related work shows that the platform is being used to carry out various attacks [11, 12, 13], but no analysis has been performed on the application itself. This research aims to close the literature gap and perform an exploratory study of Kali NetHunter Lite and its tools (e.g., MAC Changer, USB Arsenal, HID Attacks) that are installed on the OnePlus 7T smartphone using digital forensic analysis techniques. By following digital forensics methods (obtaining forensics data, preparation, identification, analysis, and reporting), our goal is to address the problem of encountering targeted operating systems and smartphones during the course of digital forensics investigations. Therefore, this study is divided into two phases to represent all aspects of possible real-life scenarios where Kali NetHunter Lite might be used, such as criminal activity or penetration testing. The first phase involves rooting the device and installing Kali NetHunter Lite. During the second phase, the tools provided by NetHunter Lite are utilized; later, the physical image of the smartphone is analyzed. Therefore, the contributions of this paper include the following:  
* Providing a detailed analysis of the NetHunter Lite application right after it has been installed.