\addtocontents{toc}{\protect\vspace{\beforebibskip}} % Place slightly below the rest of the document content in the table

%************************************************
\chapter{Concepts and Technologies}
\label{ch:concepts-and-technologies}
%************************************************

\begin{justify}
In this chapter we present the main concepts needed to understand the developed work. We also outline the main technologies used throughout this work.
\end{justify}

\section{Digital Forensics}

\begin{justify}
Digital Forensics is an area of interest for recovery and research of material and information found in any digital device capable of storing digital data to help discover information crucial for the investigation of various types of crimes. Various applications of digital forensics investigations range from supporting criminal cases to private internal corporate intrusion. In terms of technical aspects, digital forensics is divided into multiple branches involving various types of devices, including computers, network devices and mobile devices \parencite{ExaminationDigitalForensics}.
\end{justify}

\begin{justify}
Shreds of evidence found in mobile devices can range from phone calls, messages, emails and interesting application data and depending on the case, some information can be more interesting to explore. This project is specifically focused on mobile devices capable of storing messages, conversations and other information by the GBoard mobile application.
\end{justify}

\section{D Programming language}

\begin{justify}
D is a general-purpose multi-paradigm system programming language with a C-like syntax focused on writing fast, safe and readable code while keeping low-level access power. In contrast to some system languages, D emphasizes type-safe and memory-safe code, minimizing undefined behaviours and therefore maintaining the program correctness \parencite{AliProgrammingD}.
\end{justify}

\begin{justify}
In this project, the D programming language was used to develop a standalone application to help Autopsy extracting relevant information. Using its capabilities, it was possible to create a cross-platform application with a low-level approach to achieve better performance and still maintain the same readability that Jython offers, which is Python within the Java Virtual Machine, being one of the language that can be used to write Autopsy modules.
\end{justify}

\subsection{Diet Templating Language}

\begin{justify}
Diet is a generic templating language for D programming language to generate \gls{xml}-based structures at compile-time. This lancuage is highly influenced by pug\footnote{\url{https://pugjs.org/}} and \gls{haml}\footnote{\url{https://haml.info/}} languages \parencite{DietNgGithub}. In this project, Diet was used to easily generate \gls{html} reports due to the easy integration with D code.
\end{justify}

\begin{listing}[ht]
\begin{textcode}
doctype html
- auto title = "Hello, <World>";
html
	head
		title #{title} - example page
	body
		h1= title
		p.
			Simple paragraph
\end{textcode}
\caption{Example in Diet templating language}
\label{listing:DietTemplateExample}
\end{listing}

\begin{listing}[ht]
\begin{htmlcode}
<!DOCTYPE html>
<html>
	<head>
		<title>Hello, &lt;World&gt; - example page</title>
	</head>
	<body>
		<h1>Hello, &lt;World&gt;</h1>
		<p>Simple paragraph</p>
	</body>
</html>
\end{htmlcode}
\caption{Generated \acrshort{html} example from a Diet template}
\label{listing:DietTemplateOutputExample}
\end{listing}

\begin{justify}
Listing \ref{listing:DietTemplateOutputExample} shows an example of the generated output of the Listing \ref{listing:DietTemplateExample} code.
\end{justify}

\section{SQL Query Language and SQLite}

\begin{justify}
The \acrfull{sql} is a query language designed to gather, define, control or manipulate structured data managed and stored by a \gls{rdbms}. It is useful to provide an \gls{api} for the application to access data from a database. SQLite is an implementation of an \gls{rdbms} written in C, intended to be used as a library \parencite{SQL_RFC6922}. This \gls{rdbms} is a popular solution for many software to store information in the local storage because it does not require a client-server connection. SQLite is one of the most used database engines in the Android operation system with a mature and stable \gls{api}\footnote{\url{https://developer.android.com/reference/android/database/sqlite/package-summary}} \parencite{SQLiteWebAbout}.
\end{justify}

\begin{justify}
Particularly, GBoard uses SQLite to store a personal dictionary, temporary training cache, clipboard data, and emojis expression history. To fetch all that data in the standalone application, we used a wrapper library written in D called \path{d2sqlite3}\footnote{\url{https://github.com/dlang-community/d2sqlite3}} that uses the official SQLite C library under the hood. This wrapper library provides a safer \gls{api} and can handle built-in D types.
\end{justify}

\section{Android Operating System}

\begin{justify}
Android is one of the most widely used mobile operating system, developed by Google, based on the Linux kernel. According to statistica\footnote{\url{https://www.statista.com/}}, Android has around 1.6 billion active users worldwide with about 70\% of the market share. \parencite{AndroidStatistics} Even though Android is considered free and open-source software, most Android devices have proprietary software out of the box including \acrfull{gms} and some applications such as GBoard, Chrome and other vendor-specific applications depending on the device. Because most people use the stock Android distribution, most likely they will have GBoard installed.
\end{justify}

\begin{figure}[H]
 \centering
 \includegraphics[width=0.32\linewidth]{imgs/Android11Launcher}
 \caption[Screenshot of Android 11 Launcher]{Screenshot of a Pixel 4A running Android 11 \parencite{Pixe4AAndroidSS}}
 \label{fig:Android11Launcher}
\end{figure}

\subsection{Android Debug Bridge and Android Emulator}

\begin{justify}
\gls{adb} is a tool to make communication possible with an Android device and facilitate the process of installing and debugging an application, access a shell to run various commands and access logs. There are three main components to make communication via \gls{adb} possible: a command-line tool that acts as a client and runs on the host, a daemon, running on the Android device and a server running on the host machine that manages the communication between the client and the daemon \parencite{AndroidWebADB}.
\end{justify}

\begin{justify}
The Android Emulator is an application that simulates an Android device. It does so by running a Virtual Machine with the Android operating system. One of the best functionalities it provides is the ability to test an application on a vast number of devices with different Android \gls{api} levels, different screen density and resolution and the ability to simulate a vast number of hardware sensors.
\end{justify}

\begin{figure}[H]
 \centering
 \includegraphics[width=0.8\linewidth]{imgs/AndroidEmulator}
 \caption[Screenshot of the Android Emulator]{Screenshot of a running virtual device on Android Emulator \parencite{AndroidEmulatorImg}}
 \label{fig:AndroidEmulator}
\end{figure}

\begin{justify}
This project used both technologies to either acquire the required forensics data and test various versions of GBoards in different environments with both virtual and real-world devices. Although, acquiring forensics data via \acrshort{adb} could be very limiting, from the forensics analyzer perspective, because Android permissions are becoming more aggressive and those can somehow prevent that gathering. That being said, some alternatives such as data image dump via recovery or fastboot and even direct flash dump can be more beneficial, depending on the case.
\end{justify}

\begin{justify}
In the next chapter we presented the main concepts needed to understand the developed work. We also outlined the main technologies used throughout this work.
\end{justify}