Comparison of data acquisition technique using logical extraction method on Unrooted Android Device

Acquisition data method on Mobile Device Forensics's activity divided into two method: physical and logical extraction where each of these method has their own advantages and disadvantages. On Unrooted Android Device that have limited privilege, Logical Extraction method is used to acquire data on the device. Technique on the Logical Extraction method to acquire the data include AFLogical, SDcard Imaging, Android Backup Analysis, and proprietary applications for mobile device forensics activity such as Oxygen-Forensics. These four technique has its own acquisition technique with different capability to capture the data on the device and different activity while the acquisition data is performed. Problem in using Logical Extraction on unrooted android device is choosing right technique for data acquisition that can be used for digital evidences. Because of that problem, it's necessary to analyze several techniques on Logical Extraction method by comparing quantity of data that can be acquired and how intrusive activities performed on the device to be able to determine better acquisition technique. Best technique is technique that can acquire enough data that needed as a digital evidence without damaging the integrity of the evidence itself. On the capability to capture the data, we found that Android Backup analysis is the best technique to capture application artifact, SDCard Imaging is the best technique to captured external memory data, and Commercial provider using Oxygen-forensics is the best technique to capture other system files data with limited privilege. Finally with proving the communication log on Steam apps, after comparing all technique in Logical Extraction in safetyness (rooting or install application activities) and data captured aspect, we found that using Android Backup Analysis technique is the best technique for unrooted without doing rooting activity or installing application because of Android Backup Analysis itself is analyze the backup that created from the phone from android debug bridge which the backup store some application data on the phone. We use Steam apps case study as our proof of concept.