In Smartphone forensics, extracting and investigating the memory of Smartphones significantly impacts the investigating process. Traditional digital forensic tools are restricted to extracting the static data on flash memory, memory cards, and Subscriber Identity Module (SIM) of the smartphone. Many memory acquisition tools and memory dump analyzers can support the investigator in conducting smartphone memory forensics regarding cybercrime events.
Over the past decade, forensic practitioners and investigators have increasingly focused on memory forensic techniques impacting cybercrime investigations and real forensics significantly. Smartphone memory forensics examines and recovers the artifacts and objects from the process memory space to enforce the quality of investigation. However, the memory forensics models lack to determine the context and origin of the evidence in the recovered artifacts without the knowledge of the application logic.
In contrast to traditional disk forensics, Smartphone memory forensics extracts the volatile data from the memory space by the scientific community and forensic examiners. With the emergence of the memory-resident mobile malware, the process of extracting the text and string data from smartphone memory images has changed in recent years. The sophisticated capabilities of the semantic forensic analysis with the advanced tools, algorithms, and techniques design greatly assist the recovery of the evidence from the volatile memory for investigation of the malware effects.