25th USENIX Security Symposium has ended
Back To Schedule
Friday, August 12 • 5:00pm - 5:30pm
Screen after Previous Screens: Spatial-Temporal Recreation of Android App Displays from Memory Images

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Smartphones are increasingly involved in cyber and real world crime investigations. In this paper, we demonstrate a powerful smartphone memory forensics technique, called RetroScope, which recovers multiple previous screens of an Android app — in the order they were displayed — from the phone’s memory image. Different from traditional memory forensics, RetroScope enables spatial-temporal forensics, revealing the progression of the phone user’s interactions with the app (e.g., a banking transaction, online chat, or document editing session). RetroScope achieves near perfect accuracy in both the recreation and ordering of reconstructed screens. Further, RetroScope is app-agnostic, requiring no knowledge about an app’s internal data definitions or rendering logic. RetroScope is inspired by the observations that (1) app-internal data on previous screens exists much longer in memory than the GUI data structures that “package” them and (2) each app is able to perform context-free redrawing of its screens upon command from the Android framework. Based on these, RetroScope employs a novel interleaved re-execution engine to selectively reanimate an app’s screen redrawing functionality from within a memory image. Our evaluation shows that RetroScope is able to recover full temporally-ordered sets of screens (each with 3 to 11 screens) for a variety of popular apps on a number of different Android devices.

avatar for Golden G. Richard III

Golden G. Richard III

Professor, University of New Orleans
I'm a computer science professor who teaches and performs research in digital forensics, reverse engineering, malware analysis, and operating systems internals and also a private digital forensics investigator. I'm also a concert photographer @ High ISO Music: www.highisomusic... Read More →

Dongyan Xu

Purdue University

Xiangyu Zhang

Purdue University

Friday August 12, 2016 5:00pm - 5:30pm PDT
Zilker Ballroom 2

Attendees (2)