GUITAR: Piecing Together Android App GUIs from Memory Images

An Android app’s graphical user interface (GUI) displays rich semantic and contextual information about the smartphone’s owner and app’s execution. Such information provides vital clues to the investigation of crimes in both cyber and physical spaces. In real-world digital forensics however, once an electronic device becomes evidence most manual interactions with it are prohibited by criminal investigation protocols. Hence investigators must resort to “image-andanalyze” memory forensics (instead of browsing through the subject phone) to recover the apps’ GUIs. Unfortunately, GUI reconstruction is still largely impossible with stateof-the-art memory forensics techniques, which tend to focus only on individual in-memory data structures. An Android GUI, however, displays diverse visual elements each built from numerous data structure instances. Furthermore, whenever an app is sent to the background, its GUI structure will be explicitly deallocated and disintegrated by the And...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Brendan Saltaformaggio, Rohit Bhatia, Zhongshu Gu, Xiangyu Zhang, Dongyan Xu
• Keywords: CCS 2015, Security Privacy