{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,16]],"date-time":"2026-04-16T07:02:26Z","timestamp":1776322946721,"version":"3.50.1"},"reference-count":159,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2020,1,1]],"date-time":"2020-01-01T00:00:00Z","timestamp":1577836800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Research Management Center, Universiti Technologi Malaysia, through the Modeling Information Security Policy Field","award":["R.J130000.7113.04E96"],"award-info":[{"award-number":["R.J130000.7113.04E96"]}]},{"name":"Open Access Funding provided by the Qatar National Library"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2020]]},"DOI":"10.1109\/access.2020.3014615","type":"journal-article","created":{"date-parts":[[2020,8,6]],"date-time":"2020-08-06T20:45:29Z","timestamp":1596746729000},"page":"173359-173375","source":"Crossref","is-referenced-by-count":51,"title":["A Review of Mobile Forensic Investigation Process Models"],"prefix":"10.1109","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0729-2654","authenticated-orcid":false,"given":"Arafat","family":"Al-Dhaqm","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8824-6069","authenticated-orcid":false,"given":"Shukor Abd","family":"Razak","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7355-2314","authenticated-orcid":false,"given":"Richard Adeyemi","family":"Ikuesan","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4071-4596","authenticated-orcid":false,"given":"Victor R.","family":"Kebande","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2286-1728","authenticated-orcid":false,"given":"Kamran","family":"Siddique","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2008.341"},{"key":"ref38","first-page":"1941","article-title":"An integrated approach to recovering deleted files from NAND flash data","volume":"2","author":"luck","year":"2008","journal-title":"Small Scale Device Forensics Journal"},{"key":"ref33","first-page":"1","article-title":"Data acquisition from cell phone using logical approach","volume":"26","author":"kim","year":"2007","journal-title":"World Acad Sci Eng Technol"},{"key":"ref32","first-page":"1","article-title":"Acquisition of a Symbian smart phone’s content with an on-phone forensic tool","author":"mokhonoana","year":"2007"},{"key":"ref31","first-page":"1","article-title":"Forensics and SIM cards: An overview","volume":"5","author":"casadei","year":"2006","journal-title":"Int l J Digital Evidence"},{"key":"ref30","first-page":"191","article-title":"Forensic analysis of mobile phone internal memory","author":"willassen","year":"2005","journal-title":"Advances in Digital Forensics"},{"key":"ref37","first-page":"1","article-title":"Forensic data recovery from flash memory","volume":"1","author":"breeuwsma","year":"2007","journal-title":"Small Scale Device Forensics Journal"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-101"},{"key":"ref35","first-page":"168","article-title":"Mobile phone forensics tool testing: A database driven approach","volume":"6","author":"baggili","year":"2007","journal-title":"Int l J Digital Evidence"},{"key":"ref34","first-page":"1","article-title":"Introduction to mobile phone flasher devices and considerations for their use in mobile phone forensics","author":"al-zarouni","year":"2007"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-72"},{"key":"ref27","first-page":"1","article-title":"Forensics and the GSM mobile telephone system","volume":"2","author":"willassen","year":"2003","journal-title":"Int l J Digital Evidence"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2004.11.007"},{"key":"ref20","first-page":"1019","article-title":"Digital evidence extraction and documentation from mobile devices","volume":"2","author":"ahmed","year":"2013","journal-title":"Int J Adv Res Comput Commun Eng"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3351029"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0138449"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/AINS.2018.8631468"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3190645.3190695"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom.2013.25"},{"key":"ref26","first-page":"1","article-title":"pdd: Memory imaging and forensic analysis of palm OS devices","author":"grand","year":"2002","journal-title":"Proc 14th Annu 1st Conf Comput Secur Incident Handling Response"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/EISIC.2013.58"},{"key":"ref25","article-title":"Forensic examination of a RIM (BlackBerry) wireless device","author":"burnette","year":"2002"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/SECON.2009.5174075"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1504\/IJESDF.2009.023872"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2009.109"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1016\/j.bica.2014.07.002"},{"key":"ref156","first-page":"163","article-title":"Mapping process of digital forensic investigation framework","volume":"8","author":"selamat","year":"2008","journal-title":"Int J Comput Sci Netw Secur"},{"key":"ref155","article-title":"Selecting keyword search terms in computer forensics examinations using domain analysis and modeling","author":"bogen","year":"2006"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0170793"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3000747"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.11113\/jt.v78.9190"},{"key":"ref146","first-page":"725","article-title":"An improved ontology for knowledge management in security and digital forensics","author":"ellison","year":"2017","journal-title":"Proc 14th Eur Conf Cyber Warfare Secur"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/AINS.2017.8270424"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsisyn.2019.03.006"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2762693"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.05.010"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.08.003"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.01.001"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4302-3343-5"},{"key":"ref55","first-page":"1","article-title":"iPhone 3GS forensics: Logical analysis using apple iTunes backup utility","volume":"4","author":"bader","year":"2010","journal-title":"Small Scale Device Forensics Journal"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.01.004"},{"key":"ref53","first-page":"1","article-title":"Android forensics: Simplifying cell phone examinations","author":"lessard","year":"2010"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.02.001"},{"key":"ref40","author":"zdziarski","year":"2008","journal-title":"iPhone Forensics Recovering Evidence Personal Data and Corporate Assets"},{"key":"ref4","first-page":"322","article-title":"Smartphone forensic investigation process model","volume":"6","author":"goel","year":"2012","journal-title":"Int J Comput Sci Secur"},{"key":"ref3","first-page":"1","article-title":"Forensic investigation process model for windows mobile devices","volume":"11","author":"ramabhadran","year":"2009"},{"key":"ref6","first-page":"27","article-title":"A simple cost-effective framework for iPhone forensic analysis","author":"husain","year":"2010","journal-title":"Proc Int Conf Digit Forensics Cyber Crime"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/BWCCA.2011.63"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.4018\/IJDCF.2020070105"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-801595-7.00014-8"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/PACRIM.2009.5291378"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2014.6950491"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1002\/wfs2.1372"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1080\/00450618.2016.1194473"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2016.693"},{"key":"ref46","article-title":"iPhone forensics","author":"hoog","year":"2009"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-10619-4_11"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/WNIS.2009.32"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICUMT.2009.5345493"},{"key":"ref42","article-title":"Hashing techniques for mobile device forensics","volume":"1","author":"danker","year":"2009","journal-title":"Stress"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2008.05.010"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/IIH-MSP.2009.314"},{"key":"ref43","first-page":"16","article-title":"Issues in Symbian S60 platform forensics","volume":"6","author":"savoldi","year":"2009","journal-title":"J Commun Comput"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1080\/00450618.2016.1267797"},{"key":"ref126","first-page":"1","article-title":"Comparisons of forensic tools to recover ephemeral data from iOS apps used for cyberbullying","author":"chamberlain","year":"2019","journal-title":"Proceedings of IARIA"},{"key":"ref125","first-page":"28","article-title":"A mobile forensic readiness model aimed at minimizing cyber bullying","volume":"140","author":"kebande","year":"2016","journal-title":"Int J Comput Appl"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2020.03.390"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2011.440"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/BWCCA.2011.62"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS49300.2020.9116208"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-24106-2_26"},{"key":"ref128","article-title":"New and emerging mobile apps among teens-are forensic tools keeping up?","author":"billups","year":"2020"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-22709-7_54"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34129-8_21"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/ICCA49400.2020.9022838"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSec.2012.6246108"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-32692-9_82"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35264-5_9"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.18411\/2019-2019-2019-00002"},{"key":"ref134","article-title":"Attributing users based on Web browser history","author":"guido","year":"2017"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1088\/1757-899X\/834\/1\/012034"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-007-2792-2_5"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-23547-5_10"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.05.007"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2019.200897"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101650"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2015.7335050"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1002\/wfs2.1350"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.05.011"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/FiCloud.2016.57"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-22365-5_6"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-11534-9_2"},{"key":"ref63","author":"hoog","year":"2011","journal-title":"IPhone and IOS Forensics Investigation Analysis and Mobile Security for Apple IPhone IPad and IOS Devices"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19513-6_3"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0166930"},{"key":"ref65","author":"hoog","year":"2011","journal-title":"Android Forensics Investigation Analysis and Mobile Security for Google Android"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-017-0748-7"},{"key":"ref66","first-page":"100","article-title":"Forensic analysis of the Android file system YAFFS2","author":"quick","year":"2011"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/AINS.2017.8270436"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.05.016"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/AINS.2017.8270427"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-22339-6_21"},{"key":"ref144","first-page":"1","article-title":"A Web-based mouse dynamics visualization tool for user attribution in digital forensic readiness","author":"ernsberger","year":"2017","journal-title":"Proc 9th EAI Int Conf Digit Forensics Cyber Crime"},{"key":"ref2","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1007\/978-3-642-10619-4_11","article-title":"A process model for forensic analysis of Symbian smart phones","author":"yu","year":"2009","journal-title":"Proc Intl Conf in Software Eng Advances"},{"key":"ref69","first-page":"1","article-title":"Forensic analysis of Geodata in Android smartphones","author":"maus","year":"2010"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/ISBAST.2014.7013121"},{"key":"ref1","first-page":"155","article-title":"Identification of digital evidence on Android’s blackberry messenger using NIST mobile forensic method","volume":"15","author":"riadi","year":"2017","journal-title":"Int J Comput Sci Inf Secur"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.05.018"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/WAINA.2013.40"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.05.001"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2012.12.024"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2014.6813993"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.2991\/iccsee.2013.299"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-007-5860-5_84"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39891-9_15"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-007-6516-0_96"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2013.50"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSACW.2013.20"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.06.001"},{"key":"ref103","article-title":"Forensic analysis of social networking application on iOS devices","volume":"9067","author":"zhang","year":"2013","journal-title":"Proc SPIE"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2285360"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40861-8_38"},{"key":"ref112","first-page":"141","article-title":"Extraction of common concepts for the mobile forensics domain","author":"ali","year":"2017","journal-title":"Proc Int Conf Reliable Inf Commun Technol"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.04.003"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/ASIAJCIS.2013.21"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.03.007"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.06.011"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38980-1_23"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.483"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICECTECH.2011.5941698"},{"key":"ref12","first-page":"1","article-title":"Generic process model for Android smartphones live memory forensics","author":"paul","year":"2014"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.17781\/P001338"},{"key":"ref14","first-page":"28","article-title":"Acquisition and analysis of digital evidencein Android smartphones","author":"de lima sim ao","year":"2011"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICSSE.2013.6614664"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom.2011.75"},{"key":"ref16","first-page":"4847","article-title":"The forensic process analysis of mobile device","volume":"6","author":"sai","year":"2015","journal-title":"Int J Comput Sci Inf Technol"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2012.6412634"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2875068"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.05.003"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.10.003"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1108\/ICS-02-2014-0013"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/INNOVATIONS.2012.6207740"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31600-5_28"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30436-1_21"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.camwa.2011.09.053"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.14421\/ijid.2018.07204"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0176223"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.4018\/978-1-5225-9554-0.ch002"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.09.003"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2019.04.009"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1007\/978-81-322-2674-1_37"},{"key":"ref89","first-page":"38","article-title":"Forensic analysis of WhatsApp on Android amartphones","author":"thakur","year":"2013"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.15863\/TAS.2016.01.33.29"},{"key":"ref122","article-title":"Forensic professionals’ views on the lack of standards in the digital forensic field: A generic qualitative inquiry","author":"mcturk","year":"2019"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.18517\/ijaseit.8.3.3591"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35515-8_7"},{"key":"ref86","first-page":"b6.1","article-title":"Android forensics: A case study of the","author":"racioppo","year":"2012"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35515-8_5"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.5120\/11602-6965"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/8948470\/09160916.pdf?arnumber=9160916","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:54:59Z","timestamp":1639770899000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9160916\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020]]},"references-count":159,"URL":"https:\/\/doi.org\/10.1109\/access.2020.3014615","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020]]}}}