Forensic Data Analysis of Delivery and Transport Applications

The COVID-19 pandemic has changed many aspects of human life during last three years. One of these aspects is the adaption of new trends and technologies for everyday activities such as delivery and transportation. People now prefer to shop online and get their products delivered at home without wasting any time. Therefore, the security and importance of online and delivery applications is the main concern these days. The payment mode of these applications is online which involves personal data like bank information and user details. This problem led to the research contribution of our work. The main objective and implication of this study is to find personally identifiable information (PII) of users which uniquely identifies a person at personal and organizational scopes. In this paper, we present the forensics analysis of eight popular Android delivery and transport applications i.e. Daraz.pk, Foodpanda, Grocer app, Airlift express, Bykea, Indriver, Uber and Clicky shopping app. These applications have not been previously studied and investigated by other researchers. Furthermore, these applications are among the top android apps used by customers. It is expected that such an analysis can guide investigators towards obtaining useful information about a suspect who has used such an application on their device. The analysis process started with the installation of each application on a rooted Samsung S7 Edge smartphone. Then various activities were performed such as setting up an account, booking a ride, or ordering a delivery. After this, a physical image of the device was acquired. A detailed analysis of the image was carried out using Autopsy and all relevant artifacts were collected. A comparison of the results showed largest number of artifacts have been gathered from installation activity and the most number of unique artifacts have been collected from order and booking activity. A tabular form of analysis has also been shown with all of the source and path files from which the data has been gathered.