Context-aware evidence extraction improves mobile sqlite forensics accuracy
A Symbolic-Neural Framework for Context-Aware Evidence Extraction from Mobile SQLite Databases
Cryptography and Security
Summary
Extracting important evidence from mobile app databases is hard because the database layouts often change and are not well documented. The authors created a system called SNEEF that combines symbolic rules and neural language models to better understand and retrieve forensic data from these databases across different apps and devices. Their method links extracted information back to its original source for reliability. They tested it on real Android and iOS data and found it significantly improved accuracy over simpler approaches.
What this means in practice
- •For digital forensic examiners: Extract reliable forensic evidence from mobile apps despite undocumented and evolving database schemas using a context-aware approach.
- •For mobile security analysts: Track and verify sensitive user data provenance in mobile app SQLite databases across different OS versions using provenance binding.
Authors
Jeel Piyushkumar Khatiwala, Divyangkumar Patel, Dianxiang Xu, Weifeng Xu
Abstract
Reliable forensic evidence extraction from mobile SQLite databases is challenging because application schemas are undocumented, evolve across releases, and differ across operating systems, making schema-specific methods brittle and difficult to maintain. We present SNEEF, a symbolic-neural framework for context-aware evidence extraction that encodes each SQLite row as context-value pairs with standardized provenance metadata and column labels, uses a language model to recognize nine forensic entity types, and binds each accepted entity to its source table and row through the PA-EEP provenance protocol. We evaluate SNEEF against examiner-verified ground truth from five corpora built from public Android and iOS device images, spanning multiple application versions. SNEEF achieves an F1 score of 0.967 for evidence entities extracted from SQLite row content, excluding application names, compared with 0.728 for a context-free configuration, with consistent gains across all corpora. We also introduce an Evidence Failure Mode taxonomy to characterize why extraction errors occur.