## 4 Experiment, Results and Discussion
### Forensics Analysis: Chrome Application as a Case
#### 4.2.3 Evidence Analysis  
In this phase, we elaborate on the analysis of artifacts from forensic images:  
* Belkasoft: This tool (Figure 15) requires the selection of artifacts from each table individually, potentially leading to the loss of previously selected artifacts when switching between tables. Following the manual identification of SQLite database files, as illustrated in Figure 15, the next step involves selecting the \"SQLite\" tab to access and display all the tables within the file. Subsequently, artifacts pertinent to the case are chosen from each table, as demonstrated in Figure 15. It is worth noting that when transitioning to another table, any previously selected artifacts from the previous table will be lost unless a distinct report is generated for each artifact individually, based on the respective tables.
* MAGNET AXZIOM: After selecting the SQLite Viewer tab, MAGNET AXZIOM allows the user to browse artifacts associated with the case by choosing a specified table (Figure 16). The procedure follows a similar approach to that of the Belkasoft tool, for which the manual recognition of SQLite files is illustrated in Figure 16. Afterward, the \"SQLite VIEWER\" tab is activated, followed by the selection of the table, as demonstrated in Figure 16. Subsequently, the artifacts relevant to the case are examined. It is important to note that this tool lacks the capability to select artifacts for later inclusion in the case report; therefore, artifacts must be documented in real time during the examination process.
* FINALMobileForensics: This tool permits the viewing of SQLite file contents, but lacks support for selecting and adding artifacts to the case report later (Figures 17 and 18). Similarly, in this tool, as in the preceding ones, the process of searching for SQLite files is performed manually, as depicted in Figure 17. To access the contents of a SQLite database file, users must select the desired file and then right-click. However, it is worth noting that the SQLite DB Viewer in FINALMobile, as shown in Figure 18, does not display many of the search terms. Furthermore, this tool does not provide the option to select artifacts for later inclusion in the case report.
* FORC Tool: The FORC tool (Figure 19) streamlines evidence retrieval and enables the viewing of contents with a single click. Investigators can conveniently select artifacts and save evidence for later inclusion in the report. The FORC tool automatically acquires all SQLite files without manual intervention. To access the contents of any file, users simply need to click on the file to open its contents, and then select the desired table to view the information stored within it. One notable feature of this tool is that it enables investigators to choose artifacts for potential inclusion in the report at a later stage, as illustrated in Figure 19.  
Figure 14: Extracting SQLite files by use of the FORC tool.  
Figure 16: Artifacts of MAGNET AXZIOM.  
Figure 15: Belkasoft: Artifact selection.  
Figure 17: Viewing SQLite files with the FINALMobileForensics tool.  
Figure 18: FINALMobileForensics tool: Table contents.