{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T11:44:17Z","timestamp":1768823057356,"version":"3.49.0"},"reference-count":15,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2024,9,30]],"date-time":"2024-09-30T00:00:00Z","timestamp":1727654400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2024,9,30]]},"abstract":"<jats:p>Personal electronic devices such as smartphones and smartwatches have become indispensable daily companions, collecting a multitude of personal and sensitive data. As a result, they are of paramount importance in digital forensic examinations. However, there is a lack of publicly available and ready-to-use digital forensic datasets, especially in mobile forensics. This work presents a concept and an open-source proof-of-concept implementation, which simplifies and automates the creation of mobile forensic datasets within the scope of the Android operating system. In contrast to previous approaches, which populate the most common databases of an Android device, our concept is based on community-driven playbooks and makes use of interaction with the actual smartphone GUI. Hence, we are able to generate coherent and realistic traces as they occur in real-world human usage. Our proof-of-concept implementation is based on the standard Android emulation environment and borrows tools from the user interface testing community. Our evaluation shows that our approach actually generates realistic Android datasets. For instance, we can generate traces that cannot be simulated by gestures (e.g., changing the GPS position or triggering incoming phone calls). Recording the actual data synthesis process allows users to either create and share their own playbooks (i.e., the exact instructions for the data synthesis process rather than having to share the full image) or reproduce Android images with different scenarios using playbooks previously created and shared by the community.<\/jats:p>","DOI":"10.1145\/3688807","type":"journal-article","created":{"date-parts":[[2024,9,14]],"date-time":"2024-09-14T11:03:52Z","timestamp":1726311832000},"page":"1-19","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Data Synthesis Is Going Mobile\u2014On Community-Driven Dataset Generation for Android Devices"],"prefix":"10.1145","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-0095-6597","authenticated-orcid":false,"given":"Markus","family":"Demmel","sequence":"first","affiliation":[{"name":"University of the Bundeswehr Munich, Research Institute CODE, Neubiberg, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5670-8150","authenticated-orcid":false,"given":"Thomas","family":"G\u00f6bel","sequence":"additional","affiliation":[{"name":"University of the Bundeswehr Munich, Research Institute CODE, Neubiberg, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5561-8818","authenticated-orcid":false,"given":"Patrik","family":"Gon\u00e7alves","sequence":"additional","affiliation":[{"name":"Central Office for Information Technology in the Security Sector (ZITiS), Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9254-6398","authenticated-orcid":false,"given":"Harald","family":"Baier","sequence":"additional","affiliation":[{"name":"University of the Bundeswehr Munich, Research Institute CODE, Neubiberg, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,10,26]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1002\/wfs2.1432"},{"key":"e_1_3_2_3_2","unstructured":"Digital Corpora. 2023. Digital Corpora - Producing the Digital Body. Retrieved January 20 2023 from https:\/\/digitalcorpora.org\/"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2021.301133"},{"key":"e_1_3_2_5_2","unstructured":"Mattia Epifani. 2021. Android Third-Party Apps Forensics\u2013Reference Guide. [Online]. Poster-Online Ressource. Retrieved February 4 2023 from https:\/\/www.sans.org\/posters\/android-third-party-apps-forensics\/"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2009.06.016"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/3609863"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301344"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56223-6_5"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301439"},{"key":"e_1_3_2_11_2","first-page":"S94","volume-title":"Proceedings of the 17th Annual DFRWS Conference","author":"Grajeda Cinthya","year":"2017","unstructured":"Cinthya Grajeda, Frank Breitinger, and Ibrahim Baggili. 2017. Availability of datasets for digital forensics\u2013And what is missing. In Proceedings of the 17th Annual DFRWS Conference, S94\u2013S105."},{"key":"e_1_3_2_12_2","unstructured":"Heather Mahalik Domenica Lee Crognale and Mattia Epifani. 2021. The Most Relevant Evidence per Gigabyte. [Online]. Poster-Online Ressource. Retrieved February 4 2023 from https:\/\/sansorg.egnyte.com\/dl\/ljmbARD8io"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.3390\/forensicsci2020023"},{"key":"e_1_3_2_14_2","unstructured":"NIST. 2023. The CFReDS Project. Retrieved January 20 2023 from https:\/\/www.cfreds.nist.gov\/"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","unstructured":"Mark Scanlon Xiaoyu Du and David Lillis. 2017. EviPlant: An efficient digital forensic challenge creation manipulation and distribution solution. Digital Investigation 20 (Mar 2017) S29\u2013S36. DOI: 10.1016\/j.diin.2017.01.010","DOI":"10.1016\/j.diin.2017.01.010"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20125-2_14"}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3688807","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3688807","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:04:09Z","timestamp":1750291449000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3688807"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,30]]},"references-count":15,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2024,9,30]]}},"alternative-id":["10.1145\/3688807"],"URL":"https:\/\/doi.org\/10.1145\/3688807","relation":{},"ISSN":["2576-5337"],"issn-type":[{"value":"2576-5337","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9,30]]},"assertion":[{"value":"2024-04-21","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-07-03","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-10-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}