<![CDATA[Background: The increasing use of smartphones has been accompanied by the growing misuse of mobile devices in cybercrime, making mobile forensics essential for identifying, acquiring, recovering, and analyzing digital evidence. However, standardized mobile forensic investigation models for field implementation remain limited. The Harmonized Mobile Forensic Investigation Process Model (HMFIPM) has been proposed as a structured investigation model, but its empirical implementation in an accredited forensic laboratory environment remains underexplored. Objective: This study aims to empirically validate the implementation of HMFIPM as a structured process model for Android mobile forensic investigations within an ISO/IEC 17025-accredited Digital Forensics Laboratory. Methods: This study applied a descriptive and implementation-based approach. Descriptive analysis was conducted through examiner interviews, while implementation analysis was performed by applying the HMFIPM stages to a Samsung SM-A075F device using Full File System extraction with Cellebrite UFED and Android Live extraction with MD. Results: All HMFIPM stages were successfully implemented and mapped to the mobile forensic workflow in the laboratory environment. The model supported a structured, documented, and evaluable investigation process. Differences in artifact recovery were primarily caused by tool-to-method compatibility and application data architecture rather than by limitations of the HMFIPM model. Cellebrite UFED using Full File System acquisition produced more complete artifacts, while MD using Android Live extraction obtained partial application artifacts. Conclusion: HMFIPM is feasible as a standardized framework for Android mobile forensic investigation. However, the feedback mechanism requires refinement. This study proposes an additional data acquisition feedback path alongside the existing analysis feedback path, allowing examiners to revisit the acquisition stage when new investigative needs arise.]]>
Copyrights © 2026
