## 4 Experiment, Results and Discussion
### Forensics Analysis: Chrome Application as a Case
#### 4.2.4 Reporting
This newfound information, including details such as origin_host, origin_port, and received_ip_address, can be instrumental in comprehending the sequence of events under investigation. It not only bolsters the evidential strength but also aids investigators in constructing a more comprehensive and compelling narrative for presentation in a court of law. These revelations illuminate the transformative potential of the FORC tool in the realm of digital forensics. It offers a streamlined, efficient, and error-resilient alternative to traditional manual extraction methods, significantly reducing the risk of crucial evidence slipping through the cracks. By enabling investigators to uncover hidden data with ease and precision, the FORC tool empowers them to make more informed decisions, advance investigations, and ultimately contribute to a more just and equitable legal system. A comparison between BelkaSoft, MAGNET AXZIOM, FINALMobile, and FORC is shown in Table 5. The table evaluates the capabilities of four forensic tools: FORC, BelkaSoft, MAGNET AXIOM, and FINALMobile. These tools are assessed based on various criteria important for SQLite data forensics. FORC stands out as a comprehensive solution, offering a range of essential features. It includes a SQLite viewer, enabling examiners to interactively explore SQLite databases. Moreover, FORC automates the retrieval of all SQLite files, streamlining the data collection process. Its functionality extends to the selection of evidence from SQLite databases, making it convenient for investigators to pinpoint relevant data. FORC also excels in generating reports by adding all selected evidence to a single, cohesive report, simplifying the presentation of findings. In contrast, BelkaSoft, MAGNET AXIOM, and FINALMobile exhibit some limitations. While they all provide a SQLite viewer for examination purposes, none of these tools offer automatic retrieval of all SQLite files, potentially requiring manual intervention to collect data comprehensively. Additionally, when it comes to selectively choosing evidence from SQLite databases, only BelkaSoft and FORC offer this feature. However, unlike FORC, the other tools do not consolidate all selected evidence into one report, potentially making the analysis and presentation of findings less efficient. Regarding physical acquisition methods, all four tools support ADB (Android Debug Bridge) for obtaining data from Android devices. This demonstrates their versatility in acquiring digital evidence from various sources. As a conclusion from these results, the FORC tool emerges as a robust choice for SQLite data forensics, offering a combination of features that streamlines the entire investigative process, from data retrieval to evidence presentation. It stands out as a comprehensive solution in the field of digital forensics. Figure 25: Reporting and NEL: SQLite database file—nel_policies table. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Tool**} & \multirow{2}{*}{**Includes SQLite**} & \multirow{2}{*}{**Automatic**} & \multirow{2}{*}{**Select Evidence**} & \multicolumn{2}{c}{**All Selected**} & \multirow{2}{*}{**Physical**} & \multirow{2}{*}{**ADB**} \\  & & & **SQLite Files** & & & & **Report** \\ \hline BelkaSoft & Yes & No & Yes & No & Yes & Yes \\ \hline MAGNET AXZIOM & Yes & No & No & No & Yes & Yes \\ \hline FINAL Mobile & Yes & No & No & No & Yes & Yes \\ \hline FORC & Yes & Yes & Yes & Yes & Yes & Yes \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison between mobile forensics tools. Figure 26: FORC tool: Autofill data.