# Exploratory Study on Kali NetHunter Lite: A Digital Forensics Approach
## 5 Discussion  
Analyzing a new operating system is undoubtedly rewarding; however, no research comes without limitations and shortcomings. Our research was no exception to that. The most significant limitation of the research is that the Kali NetHunter is still in development and the flexibility in terms of smartphones that it is available on is restricted. Additionally, ensuring that the smartphone will be capable of performing most of the tasks narrowed down the scope of the available devices. Moreover, the inability of digital forensics software to fully read the file system was another hump on the road. While some applications were running flawlessly, with other ones we were not able to say for certain, which we will talk more about in the next paragraphs.  
Throughout this research, we experienced difficulties with rooting the OnePlus 7T smartphone. The difficulties faced were due to the smartphone being proprietary to the T-Mobile provider and North America. Once the phone was converted to Global ROM, it was much easier to root it and install the necessary software. This is important to note, as the software that analyzes the phone can default to the original OS and corrupt the final image.  
As mentioned previously, the researchers wanted to eliminate any potential software bias throughout the experiment, which is why Cleebrite UFED 4 PC, Cellebrite UFED Physical Analyzer, Magnet AXIOM Process, and Magnet AXIOM Examine were used. While both the Magnet AXIOM Examine and the Cellebrite UFED Physical Analyzer showed the same results, the presentation of the results in the Magnet AXIOM Examine was straightforward and clearer to follow.  
The methodology presented in this research was designed to explore an unknown platform, Kali NetHunter. The difference between the images was distinctive enough such that an examiner could find the differences while learning the new application. Comparing a system in three different stages ensures consistency and limits errors. The process can be replicated with many more steps, and the steps can be built upon as long as there is no contamination of the data between the phases.  
Unfortunately, not all attacks were successful. Some of the attacks (e.g., KeX Manager, SearchSploit, and MITM Framework) required additional dependencies installed, which was out of the scope of the project. Other services such as Bluetooth Arsenal, did not work due to the NetHunter Lie application not recognizing the interfaces or mismatching them. Moreover, some of the services were possibly working but there was no indication if the tool was performing optimally or not. Overall, there were enough services running for the study to be successful.  
The most important part of this experiment was the findings on the attacks performed that can aid mobile forensic investigators. As seen in the previous section, traces of the services utilized by the NetHunter Lie application are visible in numerous folders. Information such as IP address, DNS address, configuration files, logs, commands, and many more provide mobile forensic investigators with a road map to a better understanding of the application used.