{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T06:46:21Z","timestamp":1772693181180,"version":"3.50.1"},"reference-count":109,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2018,5,1]],"date-time":"2018-05-01T00:00:00Z","timestamp":1525132800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Centro 2020 Mobitrust Project","award":["CENTRO-01-0247-FEDER-003343"],"award-info":[{"award-number":["CENTRO-01-0247-FEDER-003343"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2019,5,31]]},"abstract":"<jats:p>Contemporary mobile devices are the result of an evolution process, during which computational and networking capabilities have been continuously pushed to keep pace with the constantly growing workload requirements. This has allowed devices such as smartphones, tablets, and personal digital assistants to perform increasingly complex tasks, up to the point of efficiently replacing traditional options such as desktop computers and notebooks. However, due to their portability and size, these devices are more prone to theft, to become compromised, or to be exploited for attacks and other malicious activity. The need for investigation of the aforementioned incidents resulted in the creation of the Mobile Forensics (MF) discipline. MF, a sub-domain of digital forensics, is specialized in extracting and processing evidence from mobile devices in such a way that attacking entities and actions are identified and traced. Beyond its primary research interest on evidence acquisition from mobile devices, MF has recently expanded its scope to encompass the organized and advanced evidence representation and analysis of future malicious entity behavior. Nonetheless, data acquisition still remains its main focus. While the field is under continuous research activity, new concepts such as the involvement of cloud computing in the MF ecosystem and the evolution of enterprise mobile solutions\u2014particularly mobile device management and bring your own device\u2014bring new opportunities and issues to the discipline. The current article presents the research conducted within the MF ecosystem during the last 7 years, identifies the gaps, and highlights the differences from past research directions, and addresses challenges and open issues in the field.<\/jats:p>","DOI":"10.1145\/3177847","type":"journal-article","created":{"date-parts":[[2018,5,1]],"date-time":"2018-05-01T12:00:39Z","timestamp":1525176039000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":43,"title":["Current and Future Trends in Mobile Device Forensics"],"prefix":"10.1145","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1097-7742","authenticated-orcid":false,"given":"Konstantia","family":"Barmpatsalou","sequence":"first","affiliation":[{"name":"University of Coimbra, Coimbra, Portugal"}]},{"given":"Tiago","family":"Cruz","sequence":"additional","affiliation":[{"name":"University of Coimbra, Coimbra, Portugal"}]},{"given":"Edmundo","family":"Monteiro","sequence":"additional","affiliation":[{"name":"University of Coimbra, Coimbra, Portugal"}]},{"given":"Paulo","family":"Simoes","sequence":"additional","affiliation":[{"name":"University of Coimbra, Coimbra, Portugal"}]}],"member":"320","published-online":{"date-parts":[[2018,5]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Retrieved","year":"2013","unstructured":"504ensics Labs. 2013 . LiME\u2014Linux Memory Extractor . Retrieved April 10, 2015, from https:\/\/github.com\/504ensicsLabs\/LiME\/tree\/master\/doc. 504ensics Labs. 2013. LiME\u2014Linux Memory Extractor. Retrieved April 10, 2015, from https:\/\/github.com\/504ensicsLabs\/LiME\/tree\/master\/doc."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.04.003"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2767005"},{"key":"e_1_2_1_5_1","volume-title":"Retrieved","year":"2016","unstructured":"Autopsy. 2016 . Autopsy\u2014The Sleuth Kit . Retrieved January 12, 2016, from http:\/\/www.sleuthkit.org\/autopsy. Autopsy. 2016. Autopsy\u2014The Sleuth Kit. Retrieved January 12, 2016, from http:\/\/www.sleuthkit.org\/autopsy."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2015.39"},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the 10th International Conference on Cyber Warfare and Security (ICCWS\u201915)","author":"Barmpatsalou Konstantia","year":"2015","unstructured":"Konstantia Barmpatsalou , Bruno Sousa , Edmundo Monteiro , and Paulo Simoes . 2015 . Mobile forensics for PPDR communications: How and why . In Proceedings of the 10th International Conference on Cyber Warfare and Security (ICCWS\u201915) . 30. Konstantia Barmpatsalou, Bruno Sousa, Edmundo Monteiro, and Paulo Simoes. 2015. Mobile forensics for PPDR communications: How and why. In Proceedings of the 10th International Conference on Cyber Warfare and Security (ICCWS\u201915). 30."},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSIT.2013.6588754"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.12720\/jcm.8.11.708-715"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 9th EAI International Conference on Digital Forensics and Cyber Crime.","author":"Barmpatsalou Konstantia","year":"2017","unstructured":"Konstantia Barmpatsalou , Tiago Cruz , Edmundo Monteiro , and Paulo Simoes . 2017 . Fuzzy system-based suspicious pattern detection in mobile forensic evidence . In Proceedings of the 9th EAI International Conference on Digital Forensics and Cyber Crime. Konstantia Barmpatsalou, Tiago Cruz, Edmundo Monteiro, and Paulo Simoes. 2017. Fuzzy system-based suspicious pattern detection in mobile forensic evidence. In Proceedings of the 9th EAI International Conference on Digital Forensics and Cyber Crime."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.10.003"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCPCT.2017.8074287"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.008"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.3855"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/3021385.3021421"},{"key":"e_1_2_1_19_1","volume-title":"Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet","author":"Casey Eoghan","unstructured":"Eoghan Casey . 2011. Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet ( 3 rd ed.). Academic Press . Eoghan Casey. 2011. Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press.","edition":"3"},{"key":"e_1_2_1_20_1","volume-title":"Smartphone forensics and mobile malware analysis. Retrieved","author":"Casey Eoghan","year":"2015","unstructured":"Eoghan Casey . 2013. Smartphone forensics and mobile malware analysis. Retrieved February 4, 2015 , from http:\/\/www.caseite.com\/content\/smartphone-forensics-and-mobile-malware-analysis. Eoghan Casey. 2013. Smartphone forensics and mobile malware analysis. Retrieved February 4, 2015, from http:\/\/www.caseite.com\/content\/smartphone-forensics-and-mobile-malware-analysis."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2015.01.014"},{"key":"e_1_2_1_22_1","volume-title":"Retrieved","author":"Predictions Cellebrite","year":"2015","unstructured":"Cellebrite Predictions . 2015 . Mobile Forensics: A look ahead . Retrieved April 10, 2015, from http:\/\/www.cellebrite.com\/Media\/Default\/Files\/CellebritePredictions20Survey202015.pdf. Cellebrite Predictions. 2015. Mobile Forensics: A look ahead. Retrieved April 10, 2015, from http:\/\/www.cellebrite.com\/Media\/Default\/Files\/CellebritePredictions20Survey202015.pdf."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICGEC.2011.46"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/IASP.2011.6109117"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.05.015"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2014.594"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1080\/00450618.2016.1153714"},{"key":"e_1_2_1_28_1","volume-title":"Proceedings of the Conference on Information Security for South Africa (ISSA\u201911)","author":"Delport Waldo","year":"2011","unstructured":"Waldo Delport , Martin S. Olivier , and Michael Kohn . 2011 . Isolating a cloud instance for a digital forensic investigation . In Proceedings of the Conference on Information Security for South Africa (ISSA\u201911) . Waldo Delport, Martin S. Olivier, and Michael Kohn. 2011. Isolating a cloud instance for a digital forensic investigation. In Proceedings of the Conference on Information Security for South Africa (ISSA\u201911)."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1080\/00450618.2015.1066854"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSec.2012.6246108"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.5555\/1991416.1991433"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0138449"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.05.001"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2015.81"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.camwa.2011.09.053"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2013.592"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-801595-7.00016-1"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.05.016"},{"key":"e_1_2_1_41_1","unstructured":"George Grispos Tim Storer and William Bradley Glisson. 2012. Calm before the storm: The challenges of cloud computing in digital forensics. arXiv:1410.2123. http:\/\/arxiv.org\/abs\/1410.2123  George Grispos Tim Storer and William Bradley Glisson. 2012. Calm before the storm: The challenges of cloud computing in digital forensics. arXiv:1410.2123. http:\/\/arxiv.org\/abs\/1410.2123"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.06.002"},{"key":"e_1_2_1_43_1","volume-title":"Proceedings of the Master of Information Systems Security Research 2014 Convocation. 1--8.","author":"Hanaysha Tareq","year":"2014","unstructured":"Tareq Hanaysha , Dale Lindskog , and Ron Ruhl . 2014 . Using open source tools to investigate malware in the Android operating system . In Proceedings of the Master of Information Systems Security Research 2014 Convocation. 1--8. Tareq Hanaysha, Dale Lindskog, and Ron Ruhl. 2014. Using open source tools to investigate malware in the Android operating system. In Proceedings of the Master of Information Systems Security Research 2014 Convocation. 1--8."},{"key":"e_1_2_1_44_1","article-title":"A small scale digital device forensics ontology","volume":"1","author":"Harrill David Christopher","year":"2007","unstructured":"David Christopher Harrill and Richard P. Mislan . 2007 . A small scale digital device forensics ontology . Small Scale Device Forensics J. 1 , 1 (2007). David Christopher Harrill and Richard P. Mislan. 2007. A small scale digital device forensics ontology. Small Scale Device Forensics J. 1, 1 (2007).","journal-title":"Small Scale Device Forensics J."},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.005"},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the 11th Australian Digital Forensics Conference. http:\/\/ro.ecu.edu.au\/adf\/123","author":"Heriyanto Andri P.","year":"2013","unstructured":"Andri P. Heriyanto . 2013 . Procedures and tools for acquisition and analysis of volatile memory on Android smartphones . In Proceedings of the 11th Australian Digital Forensics Conference. http:\/\/ro.ecu.edu.au\/adf\/123 . Andri P. Heriyanto. 2013. Procedures and tools for acquisition and analysis of volatile memory on Android smartphones. In Proceedings of the 11th Australian Digital Forensics Conference. http:\/\/ro.ecu.edu.au\/adf\/123."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/IMF.2014.8"},{"key":"e_1_2_1_48_1","volume-title":"Proceedings of the Afternoon Session on 1-Rootkit and Network Security and Forensics.","author":"Homem Irvin","year":"2016","unstructured":"Irvin Homem . 2016 . Towards automation in digital investigations: Seeking efficiency in digital forensics in mobile and cloud environments . In Proceedings of the Afternoon Session on 1-Rootkit and Network Security and Forensics. Irvin Homem. 2016. Towards automation in digital investigations: Seeking efficiency in digital forensics in mobile and cloud environments. In Proceedings of the Afternoon Session on 1-Rootkit and Network Security and Forensics."},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.5555\/2021191"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSNW.2011.5958860"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/Trustcom.2015.488"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.03.011"},{"key":"e_1_2_1_53_1","unstructured":"ISO\/IEC. 2012. Guidelines for Identification Collection Acquisition and Preservation of Digital Evidence. ISO\/IEC.  ISO\/IEC. 2012. Guidelines for Identification Collection Acquisition and Preservation of Digital Evidence. ISO\/IEC."},{"key":"e_1_2_1_54_1","unstructured":"ISO\/IEC. 2015a. Guidelines for the Analysis and Interpretation of Digital Evidence. ISO\/IEC.  ISO\/IEC. 2015a. Guidelines for the Analysis and Interpretation of Digital Evidence. ISO\/IEC."},{"key":"e_1_2_1_55_1","unstructured":"ISO\/IEC. 2015b. Guidelines for the Analysis and Interpretation of Digital Evidence. ISO\/IEC.  ISO\/IEC. 2015b. Guidelines for the Analysis and Interpretation of Digital Evidence. ISO\/IEC."},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-101"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.05.001"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2009.06.014"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1111\/1556-4029.12511"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICITST.2014.7038797"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.4018\/ijdcf.2015040101"},{"key":"e_1_2_1_63_1","volume-title":"Proceedings of the 5th Australian Digital Forensics Conference.","author":"Kessler Gary C.","year":"2007","unstructured":"Gary C. Kessler . 2007 . Anti-forensics and the digital investigator . In Proceedings of the 5th Australian Digital Forensics Conference. Gary C. Kessler. 2007. Anti-forensics and the digital investigator. In Proceedings of the 5th Australian Digital Forensics Conference."},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.062613.00160"},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.02.001"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.05.001"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASONAM.2012.165"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/MINES.2011.77"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2012.33"},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1117\/12.879319"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.07.001"},{"key":"e_1_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCC.2014.69"},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-801595-7.00014-8"},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-801595-7.00015-X"},{"key":"e_1_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom.2011.75"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1109\/CyberC.2012.26"},{"key":"e_1_2_1_78_1","volume-title":"Mem Tri: Memory Forensics Triage Tool. Technical Report","author":"Michalas Antonis","year":"2016","unstructured":"Antonis Michalas and Rohan Murray . 2016 . Mem Tri: Memory Forensics Triage Tool. Technical Report . Cyber Security Group , University of Westminster. http:\/\/westminsterresearch.wmin.ac.uk\/id\/eprint\/17867. Antonis Michalas and Rohan Murray. 2016. Mem Tri: Memory Forensics Triage Tool. Technical Report. Cyber Security Group, University of Westminster. http:\/\/westminsterresearch.wmin.ac.uk\/id\/eprint\/17867."},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/3139923.3139926"},{"key":"e_1_2_1_81_1","volume-title":"Proceedings of the Southern African Telecommunication Networks and Applications Conference.","author":"Pontjho","unstructured":"Pontjho M. Mokhonoana and Martin S. Olivier. 2007. Acquisition of a Symbian smart phone\u2019s content with an on-phone forensic tool . In Proceedings of the Southern African Telecommunication Networks and Applications Conference. Pontjho M. Mokhonoana and Martin S. Olivier. 2007. Acquisition of a Symbian smart phone\u2019s content with an on-phone forensic tool. In Proceedings of the Southern African Telecommunication Networks and Applications Conference."},{"key":"e_1_2_1_82_1","volume-title":"Outsourcing business to cloud computing services: Opportunities and challenges","author":"Motahari-Nezhad Hamid R.","unstructured":"Hamid R. Motahari-Nezhad , Bryan Stephenson , and Sharad Singhal . 2009. Outsourcing business to cloud computing services: Opportunities and challenges . IEEE Internet Computing, Special Issue on Cloud Computing. Submitted . Hamid R. Motahari-Nezhad, Bryan Stephenson, and Sharad Singhal. 2009. Outsourcing business to cloud computing services: Opportunities and challenges. IEEE Internet Computing, Special Issue on Cloud Computing. Submitted."},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38980-1_23"},{"key":"e_1_2_1_85_1","volume-title":"Developing Process for Mobile Device Forensics. Retrieved","author":"Murphy Cynthia A.","year":"2018","unstructured":"Cynthia A. Murphy . 2013. Developing Process for Mobile Device Forensics. Retrieved April 9, 2018 , from https:\/\/digital-forensics.sans.org\/media\/mobile-device-forensic-process-v3.pdf. Cynthia A. Murphy. 2013. Developing Process for Mobile Device Forensics. Retrieved April 9, 2018, from https:\/\/digital-forensics.sans.org\/media\/mobile-device-forensic-process-v3.pdf."},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2011.59"},{"key":"e_1_2_1_87_1","volume-title":"Nyuki Android Process Dumper User Guide. Retrieved","author":"Nguli Daniel","year":"2018","unstructured":"Daniel Nguli , Almerindo Graziano , George Nicolaou , and Juma Fredrick . 2014. Nyuki Android Process Dumper User Guide. Retrieved April 9, 2018 , from http:\/\/www.silensec.com\/images\/images\/nyuki_aprocdump_user_guide.pdf. Daniel Nguli, Almerindo Graziano, George Nicolaou, and Juma Fredrick. 2014. Nyuki Android Process Dumper User Guide. Retrieved April 9, 2018, from http:\/\/www.silensec.com\/images\/images\/nyuki_aprocdump_user_guide.pdf."},{"key":"e_1_2_1_88_1","first-page":"7776","article-title":"Forensic-as-a-service for mobile devices (literature survey)","volume":"5","author":"Ninawe Prashant N.","year":"2014","unstructured":"Prashant N. Ninawe and Shrikant B. Ardhapurkar . 2014 . Forensic-as-a-service for mobile devices (literature survey) . Int. J. Comput. Sci. Inform. Technol. 5 , 6 (2014), 7776 -- 7778 . Prashant N. Ninawe and Shrikant B. Ardhapurkar. 2014. Forensic-as-a-service for mobile devices (literature survey). Int. J. Comput. Sci. Inform. Technol. 5, 6 (2014), 7776--7778.","journal-title":"Int. J. Comput. Sci. Inform. Technol."},{"key":"e_1_2_1_89_1","volume-title":"Retrieved","year":"2016","unstructured":"NowSecure. 2016 . NowSecure: Power-efficient MF for Android and iOS . Retrieved January 12, 2016, from https:\/\/www.nowsecure.com\/forensics. NowSecure. 2016. NowSecure: Power-efficient MF for Android and iOS. Retrieved January 12, 2016, from https:\/\/www.nowsecure.com\/forensics."},{"key":"e_1_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.01.004"},{"key":"e_1_2_1_91_1","volume-title":"Digital Forensic Research Workshop.","author":"Palmer Gary","year":"2001","unstructured":"Gary Palmer . 2001 . A Road Map for Digital Forensic Research. Technical Report DTRT0010-01 . Digital Forensic Research Workshop. Gary Palmer. 2001. A Road Map for Digital Forensic Research. Technical Report DTRT0010-01. Digital Forensic Research Workshop."},{"key":"e_1_2_1_92_1","volume-title":"Worldwide Cloud Applications Market Forecast 2015-2019. Retrieved","author":"Pang Albert","year":"2018","unstructured":"Albert Pang . 2015. Worldwide Cloud Applications Market Forecast 2015-2019. Retrieved April 9, 2018 , from http:\/\/www.appsruntheworld.com\/worldwide-cloud\/applications-market-forecast-2015-2019. Albert Pang. 2015. Worldwide Cloud Applications Market Forecast 2015-2019. Retrieved April 9, 2018, from http:\/\/www.appsruntheworld.com\/worldwide-cloud\/applications-market-forecast-2015-2019."},{"key":"e_1_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.02.003"},{"key":"e_1_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1145\/2598918.2598920"},{"key":"e_1_2_1_95_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2014.09.002"},{"key":"e_1_2_1_96_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCORED.2009.5443431"},{"key":"e_1_2_1_97_1","volume-title":"State of the Cloud Report. Retrieved","year":"2016","unstructured":"RightScale. 2016. State of the Cloud Report. Retrieved April 4, 2016 , from http:\/\/assets.rightscale.com\/uploads\/pdfs\/RightScale-2016-State-of-the-Cloud-Report.pdf. RightScale. 2016. State of the Cloud Report. Retrieved April 4, 2016, from http:\/\/assets.rightscale.com\/uploads\/pdfs\/RightScale-2016-State-of-the-Cloud-Report.pdf."},{"key":"e_1_2_1_98_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-382165-2.00325-1"},{"key":"e_1_2_1_99_1","first-page":"19","article-title":"Computer forensics field triage process model","volume":"1","author":"Rogers Marcus K.","year":"2006","unstructured":"Marcus K. Rogers , James Goldman , Rick Mislan , Timothy Wedge , and Steve Debrota . 2006 . Computer forensics field triage process model . J. Digital Forensics, Secur. Law 1 , 2 (2006), 19 -- 38 . Marcus K. Rogers, James Goldman, Rick Mislan, Timothy Wedge, and Steve Debrota. 2006. Computer forensics field triage process model. J. Digital Forensics, Secur. Law 1, 2 (2006), 19--38.","journal-title":"J. Digital Forensics, Secur. Law"},{"key":"e_1_2_1_100_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.02.004"},{"key":"e_1_2_1_101_1","volume-title":"Ontology-Based Intelligent Network-Forensics Investigation. Retrieved","author":"Saad Sherif","year":"2018","unstructured":"Sherif Saad and Issa Traore . 2010. Ontology-Based Intelligent Network-Forensics Investigation. Retrieved April 9, 2018 , from https:\/\/pdfs.semanticscholar.org\/3a33\/c4f3215ddc284ff87532753fe40b4f1d1d4.pdf. Sherif Saad and Issa Traore. 2010. Ontology-Based Intelligent Network-Forensics Investigation. Retrieved April 9, 2018, from https:\/\/pdfs.semanticscholar.org\/3a33\/c4f3215ddc284ff87532753fe40b4f1d1d4.pdf."},{"key":"e_1_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.5120\/13504-1253"},{"key":"e_1_2_1_103_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813650"},{"key":"e_1_2_1_104_1","unstructured":"SALUS. 2014. Deliverable 7.1 SALUS PPDR Platform\u2014Intermediate. Retrieved April 9 2018 from http:\/\/www.sec-salus.eu\/wp-content\/uploads\/2014\/05\/SALUS_D7.1_v1.1.pdf.  SALUS. 2014. Deliverable 7.1 SALUS PPDR Platform\u2014Intermediate. Retrieved April 9 2018 from http:\/\/www.sec-salus.eu\/wp-content\/uploads\/2014\/05\/SALUS_D7.1_v1.1.pdf."},{"key":"e_1_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1109\/SNCC.2014.6866510"},{"key":"e_1_2_1_106_1","volume-title":"Proceedings of the 2nd International Conference on Cyber Security, Cyber Peacefare, and Digital Forensic (CyberSec\u201913)","author":"Schutz Philip","year":"2013","unstructured":"Philip Schutz , Michael Breuer , Hans Hofken , and Marko Schuba . 2013 . Malware proof on mobile phone exhibits based on GSM\/GPRS traces . In Proceedings of the 2nd International Conference on Cyber Security, Cyber Peacefare, and Digital Forensic (CyberSec\u201913) . 89--96. Philip Schutz, Michael Breuer, Hans Hofken, and Marko Schuba. 2013. Malware proof on mobile phone exhibits based on GSM\/GPRS traces. In Proceedings of the 2nd International Conference on Cyber Security, Cyber Peacefare, and Digital Forensic (CyberSec\u201913). 89--96."},{"key":"e_1_2_1_107_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.10.004"},{"key":"e_1_2_1_108_1","doi-asserted-by":"publisher","DOI":"10.1080\/00450618.2015.1021379"},{"key":"e_1_2_1_109_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-12-801595-7.00019-7"},{"key":"e_1_2_1_110_1","volume-title":"Retrieved","year":"2016","unstructured":"Silensec. 2016 . Nyuki Forensic Investigator (NFI) . Retrieved January 12, 2016, from http:\/\/www.silensec.com. Silensec. 2016. Nyuki Forensic Investigator (NFI). Retrieved January 12, 2016, from http:\/\/www.silensec.com."},{"key":"e_1_2_1_112_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2010.05.010"},{"key":"e_1_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(12)70013-2"},{"key":"e_1_2_1_114_1","volume-title":"Retrieved","author":"Systems Volatile","year":"2011","unstructured":"Volatile Systems . 2011 . The volatility framework: Volatile memory artifact extraction utility framework . Retrieved January 12, 2015, from https:\/\/www.volatilesystems.com. Volatile Systems. 2011. The volatility framework: Volatile memory artifact extraction utility framework. Retrieved January 12, 2015, from https:\/\/www.volatilesystems.com."},{"key":"e_1_2_1_116_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2285360"},{"key":"e_1_2_1_117_1","doi-asserted-by":"publisher","DOI":"10.5555\/2028067.2028074"},{"key":"e_1_2_1_118_1","doi-asserted-by":"publisher","DOI":"10.1109\/CICT.2013.6558078"},{"key":"e_1_2_1_119_1","doi-asserted-by":"publisher","DOI":"10.1145\/2484313.2484342"},{"key":"e_1_2_1_120_1","unstructured":"Shams Zawoad and Ragib Hasan. 2013. Cloud forensics: A meta-study of challenges approaches and open problems. arXiv:1302.6312. http:\/\/arxiv.org\/abs\/1302.6312  Shams Zawoad and Ragib Hasan. 2013. Cloud forensics: A meta-study of challenges approaches and open problems. arXiv:1302.6312. http:\/\/arxiv.org\/abs\/1302.6312"},{"key":"e_1_2_1_121_1","doi-asserted-by":"publisher","DOI":"10.1109\/MobileCloud.2015.32"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3177847","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3177847","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:02:54Z","timestamp":1750215774000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3177847"}},"subtitle":["A Survey"],"short-title":[],"issued":{"date-parts":[[2018,5]]},"references-count":109,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,5,31]]}},"alternative-id":["10.1145\/3177847"],"URL":"https:\/\/doi.org\/10.1145\/3177847","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,5]]},"assertion":[{"value":"2016-10-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-01-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-05-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}