## 4 Experiment, Results and Discussion
### Forensics Analysis: Chrome Application as a Case
#### 4.2.2 Evidence Examination  
In this subsection, we provide detailed insights into how each of the tested forensic tools handles evidence examination:  
* Belkasoft: Belkasoft necessitates filling out case data and importing the forensic image. It requires manually searching for SQLite files within the partition table of the image (see Figures 5-7). Figure 6 provides a comprehensive overview of the data extraction process from the forensic transcript, specifically, when conducting searches and pinpointing SQLite files. This particular approach demands a higher level of expertise and proficiency. In such instances, it becomes imperative to explore the file system and employ the partition table of the image, as depicted in Figure 7. During this phase, the investigator must delve into the intricacies of the file system, using techniques such as examining the \"hex dump\" for each file. The objective here is to identify these files based on their distinctive file headers, a point that was previously discussed. This meticulous process allows the investigator to distinguish SQLite files effectively, further enhancing the forensic analysis. Figure 5: Main interface of the Belkasoft tool. Figure 6: Belkasoft: Artifacts. * MAGNET AXZIOM: Similar to Belkasoft, MAGNET AXZIOM demands the entry of case data and the uploading of the forensic image. It also involves a manual process of selecting the necessary folder (e.g., com.android.chrome) containing user data for the Chrome application (Figures 8-10). Similar to the procedure in the Belkasoft tool, the initial step involves entering the case's particulars, as illustrated in Figure 8. Subsequently, the forensic image is uploaded to the tool for processing. Once the tool completes the processing of the forensic image, it presents a summary screen displaying the acquired artifacts, as depicted in Figure 9. Notably, the tool offers the capability of directly visualizing these artifacts, as demonstrated in Figure 10. Handling the file system is executed in a manner akin to the approach employed by Belkasoft, as illustrated in Figure 10. This process, however, is manual in nature. The investigator is responsible for selecting the relevant folder, in this case, \"com.android.chrome,\" which contains user data pertinent to the Chrome application. Following this, the investigator navigates through all subfolders nested within the \"com.android.chrome\" directory, actively seeking out SQLite files. It is important to note that this task necessitates a profound level of expertise and skill, since not all SQLite files possess identifiable extensions, rendering the recognition of SQLite files a challenging endeavor. * FINALMobileForensics: In contrast to the previous tools (Belkasoft and MAGNET AXZIOM), the FINALMobileForensics tool does not necessitate the entry of case details. Instead, it offers the option to commence directly by uploading the forensic image into the tool. However, it distinguishes itself by requiring the use of an MD5 hash as a crucial component of the forensic image analysis process, as demonstrated in Figure 11. Similar to the preceding tools, the extraction of SQLite files entails interacting with the file system and leveraging the partition table of the forensic image, as depicted in Figure 12. These files are accessible through a file explorer. As highlighted earlier, this task places a premium on the investigator's expertise and skill, demanding the ability to effectively locate these files within the system. * FORC Tool: The FORC tool simplifies the process by automatically calculating the hash code, displaying the partition table, and directly extracting data from the selected application. Additionally, it automatically extracts all SQLite files under the main folder of the selected application. Within the FORC tool's workflow, the initial step involves filling in the case data, a process detailed previously. Subsequently, the forensic image is uploaded, as illustrated in Figure 13. At this point, the tool undertakes several key operations.