Browser unable to execute script; please use the site map to navigate the site.

Evaluating the Authenticity of Smartphone Evidence

Pieterse, Olivier, and van Heerden


(Citation)Citation information

H. Pieterse, M. S. Olivier, and R. van Heerden. “Evaluating the Authenticity of Smartphone Evidence”. In: Advances in Digital Forensics XIII. Ed. by G. Peterson and S. Shenoi. Springer, 2017, pp. 41–61


The widespread use and rich functionality of smartphones have made them valuable sources of digital evidence. Malicious individuals are becoming aware of the importance of digital evidence found on smartphones and may be interested in deploying anti-forensic techniques to alter evidence and thwart investigations. It is, therefore, important to establish the authenticity of smartphone evidence.

This chapter focuses on digital evidence found on smartphones that has been created by smartphone applications and the techniques that can be used to establish the authenticity of the evidence. In order to establish the authenticity of the evidence, a better understanding of the normal or expected behavior of smartphone applications is required. This chapter introduces a new reference architecture for smartphone applications that models the components and the expected behavior of applications. Seven theories of normality are derived from the reference architecture that enable digital forensic professionals to evaluate the authenticity of smartphone evidence. An experiment conducted to examine the validity of the theories of normality indicates that the theories can assist forensic professionals in identifying authentic smartphone evidence.

(Authoritative version on publisher's site)Definitive version

The definitive version of the paper is available from the publisher.
DOI: 10.1007/978-3-319-67208-3_3

(BibTeX record)BibTeX reference

author={Heloise Pieterse and Martin S Olivier and van Heerden, Renier},
title={Evaluating the Authenticity of Smartphone Evidence},
editor={Gilbert Peterson and Sujeet Shenoi},
booktitle={Advances in Digital Forensics XIII},
year={2017} )