Development of Xiaomi Product Mobile Forensic Acquisition Framework on Second Space Features Based on SNI/ISO 27037:2014

Abstract — In conducting digital forensic activities, it must follow the rules of SOP procedures or frameworks as a reference. One of the acquisition frameworks used in digital forensics practice is ISO 27037:2014, which contains specific guidelines related to digital forensic investigation activities. On the other hand, mobile cellular is one of the branches of digital forensics that is always developing, but with the large variety of mobile devices today, ISO 27037: 2014 has not provided specific standards in the digital forensics process on mobile devices that have special features that are different from ordinary mobile devices. One of the special features provided by Xiaomi vendor developers that gives users access to cloning and creating new space in one mobile phone is called second space or second space. With this, it will be a problem for investigators when conducting forensic processes because the data acquisition process will produce 2 extraction results from one mobile device, but the SNI ISO 27037: 2014 standard has not regulated the validity of digital evidence obtained from these special features. This research will develop a framework in conducting the investigation process on Xiaomi mobile devices, because currently only Xiaomi mobile devices have a second room feature. By paying attention to the existing problems, this research will develop a framework in carrying out the acquisition process on xiaomi mobile devices on the special features of the second room based on SNI ISO 27037: 2014. It is hoped that this research can help investigators, especially DEFR (Digital Evidence First Responder) and can be a reference that can be used in the process of searching for electronic evidence that is in accordance with SNI ISO 27037: 2014 and can be accounted for in court.