{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T07:00:45Z","timestamp":1790406045316,"version":"4.1.0"},"reference-count":23,"publisher":"Wiley","license":[{"start":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:00:00Z","timestamp":1790294400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"},{"start":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:00:00Z","timestamp":1790294400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"funder":[{"DOI":"10.13039\/501100006465","name":"Korea Creative Content Agency","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006465","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003561","name":"Ministry of Culture, Sports and Tourism","doi-asserted-by":"publisher","award":["RS\u20102024\u201000439553"],"award-info":[{"award-number":["RS\u20102024\u201000439553"]}],"id":[{"id":"10.13039\/501100003561","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Journal of Forensic Sciences"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Smartphone operating systems generate artifacts such as snapshots, state databases, and usage logs to manage application state transitions during app\u2010switching. However, these artifacts differ across operating systems in storage location, format, and retention period, which limits the reproducibility and interpretability of forensic analysis even when the underlying user behavior is identical. Android's Protobuf\u2010serialized records and iOS's KTX\u2010format snapshots further complicate analysis, as their complex structures and limited tool support often necessitate manual processing. This study examines app\u2010switching artifacts on Android and iOS to reconstruct user behavior, focusing on UsageStats, Recent Tasks, and snapshot images on Android, and KnowledgeC.db, applicationState.db, and snapshot artifacts on iOS. We analyze how each platform records temporal information and application state during app\u2010switching, termination, and device reboot, and show that correlation across artifacts enables cross\u2010validation, resolving the resulting inconsistencies. The results reveal discrepancies between UsageStats records and other app\u2010switching artifacts on Android, and missing endDate values and incomplete records during abnormal termination in iOS's KnowledgeC.db. These findings demonstrate that single\u2010artifact analysis can lead to misinterpretation. We further develop an automated tool that parses, aligns, and visualizes multiple artifacts to reconstruct app\u2010transition flows, confirming its practical applicability to mobile forensic analysis.<\/jats:p>","DOI":"10.1111\/1556-4029.70475","type":"journal-article","created":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T06:41:53Z","timestamp":1790404913000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Reconstructing user behavior with Android and\n                    <scp>iOS<\/scp>\n                    app\u2010switching artifacts"],"prefix":"10.1111","author":[{"given":"Sejin","family":"Seong","sequence":"first","affiliation":[{"name":"Digital Forensics Division Korea National Police Agency  Gwangju Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Eunjin","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Forensic Science Sungkyunkwan University  Seoul Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sunbum","family":"Song","sequence":"additional","affiliation":[{"name":"Digital Forensics Division Korea National Police Agency  Seoul Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Soojin","family":"Kim","sequence":"additional","affiliation":[{"name":"Digital Forensics Division Korea National Police Agency  Seoul Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sangeun","family":"Lee","sequence":"additional","affiliation":[{"name":"Criminal Investigation Division, Dongjak Police Station Korea National Police Agency  Seoul Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gibum","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Forensic Science Sungkyunkwan University  Seoul Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","published-online":{"date-parts":[[2026,9,25]]},"reference":[{"key":"e_1_2_10_2_1","unstructured":"Cellebrite.Industry Trends \u2013 From Access to Insight: Modernizing Digital Investigations.2026. Available from:https:\/\/media.cellebrite.com\/wp\u2010content\/uploads\/2026\/02\/2026\u2010Industry\u2010Trends\u2010Survey\u2010Report\u2010Web.pdf. Accessed 8 Jun 2026"},{"key":"e_1_2_10_3_1","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1007\/978-3-642-19513-6_3","volume-title":"Digital forensics and cyber crime. ICDF2C 2010","author":"Husain MI","year":"2011"},{"key":"e_1_2_10_4_1","unstructured":"Android Developer.Activity. Available from:https:\/\/developer.android.com\/reference\/android\/app\/Activity. Accessed 5 Sep 2025"},{"key":"e_1_2_10_5_1","unstructured":"Android Developer.The activity lifecycle. Available from:https:\/\/developer.android.com\/guide\/components\/activities\/activity\u2010lifecycle. Accessed 5 Sep 2025"},{"key":"e_1_2_10_6_1","unstructured":"Apple Inc.Apple Developer Documentation: Scene. Available from:https:\/\/developer.apple.com\/documentation\/swiftui\/scene. Accessed 10 Sep 2025"},{"key":"e_1_2_10_7_1","unstructured":"Apple Inc.Apple Developer Documentation: ScenePhase. Available from:https:\/\/developer.apple.com\/documentation\/swiftui\/scenephase. Accessed 10 Sep 2025"},{"key":"e_1_2_10_8_1","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1016\/B978-0-12-374267-4.00004-5","volume-title":"Handbook of digital forensics and investigation","author":"Casey E","year":"2010"},{"key":"e_1_2_10_9_1","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1007\/978-3-030-68734-2_8","volume-title":"Digital forensics and cyber crime. ICDF2C 2020","author":"Bortnik L","year":"2021"},{"key":"e_1_2_10_10_1","doi-asserted-by":"publisher","DOI":"10.22798\/KDFS.2021.15.4.1"},{"key":"e_1_2_10_11_1","doi-asserted-by":"publisher","DOI":"10.22798\/KDFS.2024.18.2.123"},{"key":"e_1_2_10_12_1","first-page":"1","volume-title":"Proceedings of the 2024 IEEE international conference on cyber security and resilience (CSR)","author":"Dragonas E","year":"2024"},{"key":"e_1_2_10_13_1","doi-asserted-by":"publisher","DOI":"10.1111\/1556\u20104029.70174"},{"key":"e_1_2_10_14_1","unstructured":"BrignoniA.ALEAPP v3.4.0. Available from:https:\/\/github.com\/abrignoni\/ALEAPP. Accessed 5 Oct 2025"},{"key":"e_1_2_10_15_1","doi-asserted-by":"publisher","DOI":"10.22798\/KDFS.2024.18.1.63"},{"key":"e_1_2_10_16_1","doi-asserted-by":"publisher","DOI":"10.22798\/KDFS.2023.17.4.28"},{"key":"e_1_2_10_17_1","unstructured":"BrignoniA.iLEAPP v2.3.0. Available from:https:\/\/github.com\/abrignoni\/iLEAPP. Accessed 7 Oct 2025"},{"key":"e_1_2_10_18_1","first-page":"289","volume-title":"Mobile internet security. MobiSec 2021","author":"Lee J","year":"2022"},{"key":"e_1_2_10_19_1","unstructured":"Android Developer.UsageStatsManager. Available from:https:\/\/developer.android.com\/reference\/android\/app\/usage\/UsageStatsManager. Accessed 5 Sep 2025"},{"key":"e_1_2_10_20_1","unstructured":"Android Developer.Tasks and the back stack. Available from:https:\/\/developer.android.com\/guide\/components\/activities\/tasks\u2010and\u2010back\u2010stack. Accessed 8 Sep 2025"},{"key":"e_1_2_10_21_1","unstructured":"Android Developer.Secure sensitive activities. Available from:https:\/\/developer.android.com\/security\/fraud\u2010prevention\/activities. Accessed 8 Sep 2025"},{"key":"e_1_2_10_22_1","unstructured":"The Khronos Group.KTX\u2010Khronos Texture. Available from:https:\/\/www.khronos.org\/ktx\/. Accessed 12 Sep 2025"},{"key":"e_1_2_10_23_1","unstructured":"forensicposunii.iOS KnowledgeC.db Parser. Available from:https:\/\/github.com\/forensicposunii\/iOS\u2010KnowledgeC.db\u2010parser. Accessed 8 Jun 2026"},{"key":"e_1_2_10_24_1","unstructured":"forensicposunii.MobileAppSwitchForensics. Available from:https:\/\/github.com\/forensicposunii\/MobileAppSwitchForensics. Accessed 8 Jun 2026"}],"container-title":["Journal of Forensic Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/1556-4029.70475","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1111\/1556-4029.70475","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/1556-4029.70475","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T06:41:58Z","timestamp":1790404918000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1111\/1556-4029.70475"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,25]]},"references-count":23,"alternative-id":["10.1111\/1556-4029.70475"],"URL":"https:\/\/doi.org\/10.1111\/1556-4029.70475","archive":["Portico"],"relation":{},"ISSN":["0022-1198","1556-4029"],"issn-type":[{"value":"0022-1198","type":"print"},{"value":"1556-4029","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,25]]},"assertion":[{"value":"2026-03-22","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-08-24","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-09-25","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"1556-4029.70475"}}