Comparative analysis of mobile forensic tools for digital evidence recovery using NIST framework

Abstract

Purpose: to compare the performance of Magnet Axiom and Cellebrite Physical Analyzer in extracting digital evidence from Google Pixel 5a.

Method: using a quantitative approach with a comparative experimental method. A dataset of Google Pixel 5a digital images was analyzed using two forensic software tools, Magnet Axiom and Cellebrite Physical Analyzer, in accordance with the NIST framework. The process includes preservation, acquisition, examination, analysis, and reporting. The performance of both tools was quantitatively evaluated by counting the number of artifacts recovered across various data categories and was calculated using the 16 NIST mobile forensic criteria.

Findings: the Cellebrite Physical Analyzer outperformed the Axiom Magnet in recovering digital artifacts from the Google Pixel 5a, particularly for internet, geolocation, and social app data, achieving a 75% success rate compared to 56%. The Axiom Magnet performed only slightly better at SMS recovery, but was less effective for complex app data.

Implications: choosing the right forensic tool affects the success of a digital investigation; Cellebrite is more effective for in-depth analysis of modern Android devices, while manual verification is still necessary to ensure the validity of the evidence.

Originality: directly compares the performance of Magnet Axiom and Cellebrite on Google Pixel 5a with high-security stock Android, using the NIST framework to assess the effectiveness of digital data recovery and integrity.