SNEEF framework extracts forensic evidence from mobile SQLite databases
Original title: A Symbolic-Neural Framework for Context-Aware Evidence Extraction from Mobile SQLite Databases
SNEEF achieves an F1 score of 0.967 for evidence entities from SQLite row content.
Mobile SQLite schemas are undocumented and evolve across releases and OSes. SNEEF encodes rows as context-value pairs with provenance metadata, uses a language model for nine forensic entity types, and binds entities via PA-EEP. It outperforms context-free extraction with consistent gains across Android and iOS corpora.
- Encodes each SQLite row as context-value pairs with standardized provenance
- Language model recognizes nine forensic entity types
- PA-EEP protocol binds entities to source table and row
- F1 score of 0.967 vs 0.728 for context-free configuration
From the original article
1 min read at arxiv.orgReliable forensic evidence extraction from mobile SQLite databases is challenging because application schemas are undocumented, evolve across releases, and differ across operating systems, making schema-specific methods brittle and difficult to maintain.
By Jeel Piyushkumar Khatiwala · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.