Countering Forensics Software by Baiting Them

Introduction: The Blind Spot in Mobile Forensic Extraction

Assistant Professor Weihan Goh alongside researchers Joseph Lim and Isaac Soon present groundbreaking anti-forensic research exposing a critical blind spot in mobile digital forensics. While extensive research has examined methods for bypassing Android lock screens and gaining physical or logical access, digital forensics tools and law enforcement examiners operate under the fundamental assumption that once access is established, the mobile operating system and file extraction pipeline remain passive, truthful, and cooperative. The research demonstrates how adversarially modified Android environments can deploy stealthy countermeasure tripwires to silently corrupt, encrypt, or manipulate evidence in real time during extraction.

Understanding Logical Extraction and the MTP Protocol

Digital forensic extraction workflows frequently rely on logical acquisition over the Media Transfer Protocol (MTP) or Android Debug Bridge (ADB) to acquire files from shared internal and external storage. Forensics software suites—such as Cellebrite UFED / Physical Analyzer, Magnet AXIOM, and Belkasoft Evidence Center X—perform bulk, deterministic directory traversals starting from root directories or alphabetical folder listings, retrieving files sequentially without verifying whether filesystem access events trigger active background services.

The Honeytoken Baiting Mechanism on Android

The researchers developed an active anti-forensics architecture leveraging decoy files ("honeytokens") and filesystem tripwires:

Honeytoken Placement: Bait files are positioned in predictable top-level directories (e.g. /sdcard/Download or shared storage root) that commercial extraction tools invariably inspect early during their traversal routine.

Filesystem Observers (inotify): A lightweight background service monitors file descriptor events using the Linux inotify API via Android FileObserver services.

Real-Time Payload Triggering: The moment a forensic tool reads or opens the honeytoken file, the tripwire fires an automated payload that immediately encrypts or securely overwrites sensitive "crown jewel" assets (such as encrypted chat databases, SMS logs, contacts, photos, and credentials) before the forensic tool can reach those directories.

Proof of Concept: Defeating Cellebrite, Belkasoft, and Magnet AXIOM

The researchers showcase live recorded demonstrations against three premier commercial forensic solutions:

Cellebrite UFED: As Cellebrite initiated logical file extraction over MTP, touching the bait file triggered background AES encryption. The resulting Cellebrite extraction report contained only ciphertext for sensitive target databases, completely denying usable evidence to the examiner.

Belkasoft Evidence Center X: Belkasoft's top-down shared storage acquisition immediately triggered the inotify observer, encrypting crown jewel files before acquisition finished.

Magnet AXIOM: By utilizing a larger padding file in target directories to create a deliberate time buffer, the background observer successfully encrypted all designated documents and databases while Magnet AXIOM processed the acquisition queue.

Implications and Defensive Countermeasures for Forensic Examiners

The authors discuss crucial procedural adjustments for forensic investigators and software vendors:

Avoid Unverified Bulk Acquisition: Forensic examiners must reconsider relying on automated bulk MTP extractions on suspect devices.

Selective and Prioritized Extraction: Extract critical artifacts first rather than following predictable alphabetical or hierarchical paths.

Cold-System / Chip-Off Forensics: Where feasible, utilize physical memory dumps, EDL mode, or chip-off extraction to prevent device CPUs from executing running anti-forensics processes.

Forensic Tool Verification: Forensic vendors must evaluate how their tools behave within active, adversarially modified target environments.

Key Takeaways and Future Research

Device Access is Only the Beginning: Gaining physical or logical access to an Android device does not guarantee evidentiary integrity.

Active Countermeasures Pose Severe Investigative Risks: Automated, real-time tripwires can silently subvert chain of custody and forensic accuracy.

Need for Rigorous Forensic Testing: The digital forensics community must develop defenses against active anti-forensic techniques that exploit deterministic acquisition workflows.