Abstract. The proliferation of smartphones introduces new opportunities in digital forensics. One of the reasons is that smartphones are usually equipped with sensors (e.g. accelerometer, proximity sensor, etc.), hardware which can be used to infer the user's context. This context may be useful in a digital investigation, as it can aid in the rejection or acceptance of an alibi, or even reveal a suspect's actions or activities. Nonetheless, sensor data are volatile, thus are not available in post-mortem analysis. Thus, the only way to timely acquire them, in case such a need arises during a digital investigation, is by software that collects them when they are generated by the suspect's actions. In this paper we examine the feasibility of ad-hoc data acquisition from smartphone sensors by implementing a device agent for their collection in Android, as well as a protocol for their transfer. Then, we discuss our experience regarding the data collection of smartphone sensors, as well as legal and ethical issues that arises from their collection. Finally, we describe scenarios regarding the agent's preparation and use in a digital investigation. Keywords: Smartphones, Digital Forensics, Investigation Models, Sensor, Sensor Data, Information Gathering, Android. The proliferation of smartphones 1 -devices with increasing popularity due to their processing and network capabilities, low cost, and dimensions -introduces new challenges to digital forensics. This holds true, as the heterogeneity and progressive evolution of smartphone platforms increase the complexity of a digital investigation, together with the skills and toolset required to respond to a crime or incident. For instance, the different hardware and software, which is offered by smartphone platforms to increase their market share, hinder a forensic examination. This happens since dedicated software has to be implemented and cables to be acquired per case. Moreover, as smartphone cables (data or power cables) tend to be available only as long as a smartphone model is in the market. More difficulties appear in the examination of old devices that are not supported anymore. Along with the popularity of smartphones, the one of sensors (i.e. hardware that measures the user's context) is also increasing in third-party software, such as games and navigation apps. In a previous paper we have argued that sensor data are a data source which can be collected for the purpose of digital forensics (Mylonas et al., 2012b) . Sensor data may be useful in certain crimes in order to lawfully deduce the user's context. This context may provide crucial information for law enforcement authorities in a digital investigation both for the detection and sanction and the prevention of crime. In the same time, this kind of data collection is often intrusive (Mylonas et al., 2012c) and may raise ethical and legal issues pertaining to the 1 With the term smartphone we refer to the device that adheres to the definition by Theoharidou et al. (2012) . 2 secrecy of telecommunication and the privacy of the concerned persons. Due to the interference with these fundamental rights, such forms of surveillance and collection of the respective digital evidence may be implemented only in relation to crimes that are regarded by the law as "severe" or "national security threats". A generalized and indiscriminate collection of probably useful evidence against individuals at random would perceive all citizens as potentially future wrongdoers. Such a model of routine intelligence gathering against random citizens could "blow up the cornerstones of the rule of law state" (Hoffmann-Riem, 2002) . Smartphone forensics is an emerging discipline which currently appears to be still in its infancy. Nonetheless, the consumerization of smartphones has triggered the forensic community to focus on these devices' technical details as well as the collection of their data. Therefore, tools have been created which perform either physical (i.e. low level, bit to bit), or logical (i.e. data organized in logical objects, e.g. directories) data acquisition in: (a) Windows Mobile (Casey et al., 2010; Klaver, 2010; Rehault, 2010; Grispos, 2011) , (b) Symbian (Mokhonoana and Olivier, 2007; Distefano and Me, 2008; Pooters, 2010; Thing and Chua, 2012; Thing and Tan, 2012) , (c) iOS (Zdziarski, 2008; Bader and Baggili, 2010; Husain and Sridhar, 2010; Jung et al., 2011) , and (d) Android (Lessard and Kessler, 2010; Thing et al., 2010; Vidas et al., 2011; Hoog, 2011; Mutawa et al., 2012; Park et al., 2012; Sylve, 2012) . Until now the practicality of sensor data collection has not been adequately studied in the forensics literature. This is because they are time-sensitive and volatile data and therefore not available for analysis during post-mortem forensics. In (Mylonas et al., 2012b), we proposed a scheme for the ad-hoc collection of smartphone data. In specific cases and under certain conditions, the law may allow collection of smartphone data for proactive use and for the purpose of crime prevention. Furthermore, proactive collection of a smartphone's sensor data may take place in critical infrastructures for incident response and forensic readiness reasonswhen the device is considered part of this infrastructure and the use of such intrusive control fully complies with the organization's security policy, its culture and the existing legal framework. For instance, the security policy of a critical infrastructure may specify employee usage profiling -assuming the employee's informed consent -in order to mitigate the insider threat via an insider prediction model (Kandias, et al., 2010) The paper contributes the following: (a) Development of an investigation frameworks taxonomy that can be applied in smartphone forensics. (b) Study of the smartphone sensors as a potential data source for digital forensics. (c) Identification of vulnerabilities in Android's security model that enables the ad-hoc acquisition of sensors data. (d) Implementation in the Android of the acquisition software and the transport protocol of the proactive investigation scheme that was proposed in (Mylonas et al., 2012b) . (e) Evaluation of the implementation in a laboratory environment and sharing of the experience regarding the collection of sensor data. (f) In depth analysis of legal and ethical issues that arise from the ad-hoc collection of sensor data. The paper is organized as follows. The next section includes taxonomy of the digital investigation frameworks that can be used in smartphone forensics. Section 3 elaborates on sensor data in the context of digital forensics. In section 4, we present our implementation for remote, ad-hoc sensor data acquisition from smartphones. Then, we summarize our experience regarding the data collection of smartphone sensors by our tool and describe a number of scenarios regarding its use and preparation (section 5). Section 6, includes the ethical and legal issues that arise from the ad-hoc data acquisition from smartphone sensors. Finally, section 7 includes a discussion of our approach and conclusions. A Digital Forensic Investigation Framework (DFIF) describes procedures that take place before, during, and after the investigation of physical or digital crime scenes. These frame-3 works refer to methodologies and techniques capable of collecting, analyzing and interpreting digital evidence that is suitable for a forensic investigation. This investigation may be triggered either from internal sources, e.g. in a corporate investigation, or from external ones, e.g. the evidence will be presented to support a hypothesis in courts of law. This section focuses on the DFIF that have been proposed, and are suitable, for use in cell phone forensics, i.e. digital evidence is collected from a cell phone -either feature phone or smartphone (Theoharidou et al., 2012) . We organize their presentation, starting from abstract DFIF to more device-specific frameworks, i.e. in: (a) abstract DFIF, (b) DFIF for feature phones, and c) DFIF for smartphones. Abstract investigation frameworks are widely used for the collection and analysis of digital evidence without focusing on the devices' technological 'nuts and bolts'. These frameworks progressively build upon each other. Their procedures are commonly used as a basis for the construction of subsequent frameworks that are more technologically-specific. Reith et al. (2002) propose an abstract investigation framework that includes nine phases, namely: identification, preparation, approach strategy, preservation, collection, examination, analysis, presentation and returning evidence. The authors characterize their work, which extends the work from the Digital Forensics Research Working Group (DFRWS, 2001) , as abstract since it is independent of technology and crime type. The investigation framework proposed in (Casey, 2004) , includes seven steps, namely: authorization and preparation, identification, documentation, collection and preservation, examination and analysis, reconstruction, and reporting. Documentation is an on-going process that takes place in all of the framework's phases as a basic property of the investigation and is not considered as a standalone phase. Carrier and Spafford (2003; propose a framework that is based on the process of investigating physical crime scenes. The framework aids the investigator to develop and test hypotheses, as well as discover insights about events that have occurred in the crime scene. This framework includes five phases: readiness, deployment, physical crime scene investigation, digital crime scene investigation, and presentation. Among them, the first phase is of interest since it includes the necessary steps for quicker incident handling, i.e. investigation unit training, collection and training on the necessary equipment. In the same perspective, reference to forensic readiness can be found in corporate systems that integrate mechanisms for security incident handling (Tan, 2001; Weise and Powell, 2005) . The investigation framework that is proposed by Ciardhuáin (2004) is independent from the organizational/technological context and aims to have an interdisciplinary nature, i.e. to be applicable not only by technically savvy users. In this context, the framework can be applied by first responders, investigators, IT executives, and auditors. The framework describes thirteen steps, namely: awareness, authorization, planning, notification, search and identification of evidence, collection, transport, storage, examination, hypothesis, presentation, proof/defense, and dissemination. Beebe and Clark (2005) propose an investigation framework, which -in contrary to the above mentioned frameworks -is multi-tiered. The framework includes six high level phases: preparation, incident response, data collection, data analysis, findings presentation, and incident closure. The authors propose evidence triage in which collected data are prioritized according to their importance, hence reducing the volume of data that is send to the lab for examination. In the same context, Rogers et al. (2006) elaborate on forensic triage in time sensitive investigations. Their investigation framework is tailored for on-site forensics, i.e. the investigation is conducted on the crime scene, without sending any device to a lab for an exhaustive analysis. It includes the following six phases: planning, triage, usage/user profiles, chronology-/timeline, Internet activity, and case specific evidence.
Themis is an architecture that collects data from sensors in smartphones REF .
Smartphone sensor data as digital evidence
Computers & Security
Computers & Security
Computer Science