Background

With smartphones being central to digital communication, they are often critical sources of evidence in cybercrime, financial fraud, harassment, terrorism, and organized crime investigations. However, recovering deleted files, extracting chat data from secure apps like WhatsApp and Telegram, and accessing cloud-stored data (e.g., Google Takeout) remains technically challenging.

Investigators currently rely on multiple tools — often expensive or non-integrated — to retrieve partial data. There's an urgent need for a unified, affordable, and efficient forensic tool that can extract both on-device and cloud-based digital evidence.

Problem Statement

There is no single open-source or lightweight forensic tool that enables investigators to perform comprehensive mobile data extraction — including deleted data recovery, chat exports from encrypted apps, and capture of cloud archives like Google Takeout — in a forensically sound and reportable format.

Key Objectives

• Provide a reliable tool for field-level digital evidence collection
• Help reduce dependency on expensive proprietary forensic tools
• Improve investigation quality by recovering maximum data from a single source

Functional Requirements

Design and build a Mobile Forensic Toolkit (mobile app, desktop utility, or portable forensic device) capable of the following:

Core Capabilities:

1.  Deleted File Recovery:

o Recover deleted media, documents, and APKs from internal storage

o Identify file carving opportunities from unallocated space

o Metadata-based recovery (e.g., last access, deleted timestamps)

2.  WhatsApp and Telegram Chat Export:

o Export chats, media, group information, and contact lists

o Support both rooted and non-rooted environments

o Allow encrypted backup extraction (e.g., WhatsApp. crypt14 decryption with key)

o Telegram API-based export from cloud chats

3.  Cloud Data Extraction (e.g., Google Takeout):

o Automated access and parsing of Google Takeout archive

o Extract Gmail, Drive, Photos, YouTube history, and Location data

o Generate structured reports for analysis and timeline generation

4.  Reporting & Chain of Custody:

o Export forensic logs with hash verification

o Generate case-wise evidence folders with audit trails

o Support legal admissibility (e.g., timestamps, integrity hash, analyst notes)

Optional Features (Bonus)

• Visual timeline reconstruction (calls, messages, locations)
• Integration with forensic imaging tools (e.g., EDL/ADB backup import)
• Hash matching against known criminal content (e.g., CSAM, terror media)
• Region-specific language support for content decoding
• Auto-flagging sensitive/illegal keywords

Evaluation Criteria

• Depth and breadth of data extraction
• Usability and portability for field investigations
• Accuracy of recovery and integrity validation
• Compatibility across Android versions (optional iOS support)
• Report generation quality for courtroom use

Bonus Points

• Real device demo or working prototype
• User-friendly dashboard for investigators
• Lightweight/portable (USB bootable or mobile-friendly interface)
• Compliance with standard forensic frameworks (e.g., NIST, SWGDE)