Efficient Evidence Reduction Technique for Mobile Forensics based on Digital Evidence Object (DEO) Model

The Android operating system (OS) is currently the most widely used platform on smartphones, making it a critical source of digital evidence in cybercrime investigations. With its vast array of applications and features, Android OS generates and stores a significant amount of data, much of which may be relevant to criminal activities. Mobile forensics plays a crucial role in identifying and analyzing this information to produce scientifically valid evidence. However, the process of acquiring and examining data from a smartphone’s internal storage typically results in large and complex datasets that can hinder timely forensic analysis. To address this challenge, this paper proposes the implementation of the DEO Model using Python to reduce the volume of digital evidence obtained from Android-based smartphones. The DEO Model employs a structured filtering approach, narrowing the dataset to only those objects relevant to a predefined scenario. This is achieved by applying DEO parameters based on the 5W category theory (Why, When, Where, What, Who), resulting in an optimal and focused dataset. The findings demonstrate that the Python-based DEO Model significantly accelerates the mobile forensic process, and effectively reduces dataset size while both maintaining the evidence integrity and the scenario relevance. The model achieves a very low False Positive Rate (FPR) of 0,00072, indicating a minimal risk of mismatches during the object reduction process. Therefore, the findings confirm the validity and accuracy of the digital evidence obtained. This research highlights the potential of the Python-based DEO Model to enhance the efficiency of forensic investigations on Android smartphones.