A Framework for Describing Multimedia Circulation in a Smartphone Ecosystem.

Contemporary mobile devices allow almost unrestricted sharing of multimedia and other types of files. However, because smartphones and tablets can easily access the Internet and exchange files wirelessly, they have also become useful tools for criminals who perform illegal activities such as sharing contraband and distributing illegal images. Thus, the need to investigate the source and destination of a multimedia file that resides in the internal memory of a smartphone is apparent. This chapter presents a framework for illustrating and visualizing the flow of digital images extracted from Android smartphones during a forensic investigation. The approach uses "big data" concepts to facilitate the processing of diverse (semi-structured) evidence from mobile devices and extends the idea of digital evidence bags. The data used for evaluation was obtained by running experiments that involved image exchange through channels such as Bluetooth, Internet and cloud services. The study presents information about the locations where evidence resides and uses graph databases to store metadata and to visualize the relationships that connect images with apps and events.