\addtocontents{toc}{\protect\vspace{\beforebibskip}} % Place slightly below the rest of the document content in the table

%************************************************
\chapter{Introduction}
\label{ch:introduction}
%************************************************

\begin{justify}
Over the years, technology improved exponentially. This growth helped to facilitate the work in multiple industry sectors, and likewise, in the everyday life of each individual. Things like ordering food and groceries, shopping, or communicating with someone, are all tasks that are now possible to do online, and with ease. However, these improvements can be seen as a double-edge sword, in which the same can be applied to the ability to perform cybercrime. Malicious websites, catfishing, fraud, terrorism, extortion, obscene content, harassment, are some of the online crimes conducted daily. One of the perfect weapons to use for these is a mobile device.
\end{justify}

\begin{justify}
Almost all computing tasks can now be done with a mobile phone. More than 87 thousand apps are released every month in the google app store \parencite{Statista}, varying from games to business to finance to entertainment apps, and with more than 90\% of the market being free \parencite{BusinessOfApps}, all this can be found and downloaded with just a few clicks. Of these applications, some have the purpose of sharing and saving the personal data and private information of a user. Tik-Tok\footnote{\url{https://www.tiktok.com/}}, Facebook\footnote{\url{https://www.facebook.com/}}, Twitter\footnote{\url{https://twitter.com/}}, Instagram\footnote{\url{https://www.instagram.com/}}, WhatsApp\footnote{\url{https://www.whatsapp.com}}, and other social media applications are filled with conversations and posts of users. It's safe to say, with more than 3 billion active Android devices \parencite{TheVergeAndroid}, more than 1 billion active IOS devices \parencite{TheVergeIOS}, and with more than 5 billion people that currently have a mobile device \parencite{BankMyCell}, which means more than 60\% of the world population has a mobile device, that means if someone commits a crime they probably have a mobile phone. Furthermore, with almost 4 billion people actively using social media, we can assume there is a high percentage that the same individual uses a social network \parencite{Backlinko}.
\end{justify}

\begin{justify}
From a forensics point of view, this information is crucial because the same data that is shared and stored in a device or a mobile application can be collected and analyzed for the good of an investigation. Forensic science plays a big part in criminal investigations. This field helped to improve the success of cases and trials by examining and finding evidence which without science wouldn't be possible. Fingerprint scans, DNA samples, toxicology, ballistics, are some of the methods used to gather valuable information and move a step forward towards the end goal. Digital Forensics, a sub-branch of Forensic Science, takes advantage of this and other digital sources to collect valuable information. With the everyday growth of new digital applications and updates from existing ones, Digital Forensic scientists must update regularly their tools to extract information from current applications and create new tools for the upcoming and most used ones.
\end{justify}

\begin{justify}
The goal of this report is to research the Google Keyboard application and find relevant data that can be used at a forensics level. The Google Keyboard (GBoard\footnote{\url{https://play.google.com/store/apps/details?id=com.google.android.inputmethod.latin&hl=en_US&gl=US}}) application was first released in May 2016 and launched with some outstanding features and has now more than 1,000,000,000 installations \parencite{GBoardAppStore}. Its predictive typing engine was what caught our attention. What makes a keyboard's data so important is that everyone uses it for everything. Doing a simple google search, writing notes, messaging, chatting with friends in an app, and all the other activities that involve typing must be done with the help of a keyboard. So, not only could we potentially extract full conversations with a particular individual but also extract private information that was never made public, was already deleted or modified, or even see the thought process when writing a full sentence. The GBoard's predictive typing engine could give all of this. As it's able to suggest words depending on the context and the way a person writes as well as analyzing the written text to improve itself, all this information and data must be stored somewhere. As such, the objective is to research the GBoard application, find if GBoard processes data from other apps and while incognito mode, find where all data is being stored, if it can be accessed and extracted, analyze the information, filter what is most important in terms of relevant information, and create a tool that does this whole process automatically.
\end{justify}

\begin{justify}
To help us reach our goal, we will use Autopsy, a digital forensics software that makes it easier to work with The Sleuth Kit\footnote{\url{https://www.sleuthkit.org/}} plugins. The Sleuth Kit is a library of utilities to extract data from storages to facilitate forensic analysis. With this library, creating a tool to perform some type of forensic analysis is easier because much of the groundwork is already performed under the hood by the library itself, and we just have to worry about the implementation at a higher level. This saves a lot of time to think and work on other important issues like research, planning, and providing a better final product. Autopsy is a graphical user interface and is bundled with The Sleuth Kit. This tool serves the purpose of displaying the results of an analysis, making it easier to flag the data collected.
\end{justify}

\section{Motivation}

\begin{justify}
In the digital forensic analysis world, gathering information is everything. Every bit of information counts, and sometimes even one that can be considered insignificant by many can turn the tables on an ongoing investigation. However, analyzing information about an individual's personal and private data has a higher chance of achieving the end goal. The Google Keyboard (GBoard) provides this kind of data even after its been deleted from its origins. Access to private conversations, google searches and notes is some of the information that can be extracted from this keyboard. This is accompanied by the date and time the action was performed, in what application it was performed, and, with the case of special words such as emojis, how many times they were used. These were the reasons and motivations behind the birth of this project. Furthermore to add weight to this investigation and to give credibility to what it was believed (the data could be extracted), a group of people in the forensics analysis world had released an article on their blog talking about the contents stored within GBoard \parencite{GoogleGBoardBlog}.
\end{justify}

\section{Objectives}

\begin{justify}
 The main goal of this project is to build a module for Autopsy, an open source application to forensically process digital devices, to analyze interesting GBoard artifacts for this purpose. To acheive this, the project is subdivided into three objectives:

\begin{enumerate}
    \item \textbf{Analyze and explore GBoard components and functionalities on an Android system:} GBoard is composed by various components such as basic functionality of manual texting, translation, voice-to-text, integrated search and clipboard management. It is important to evaluate which component is more important and explore them in terms of digital forensics value.
    \item \textbf{Identify the artifacts created by using GBoard on an Android system:} Even if a certain component is very valuable for forensic analysis, it is important to identify which artifacts are generated by different versions of GBoard, identify in which capability they correspond to and how important they are compared to its functionality in terms of its outcome for forensics analysis.
    \item \textbf{Development and integration of various technologies to facilitate investigation of forensic cases:} It is very important to have tools and integrate them with existing ones to facilitate the investigation of forensic cases by automating certain tasks of extraction and selection.
\end{enumerate}
\end{justify}

\section{Contributions}

\begin{justify}
Within the scope of this project, some relevant contributions were made, such as:
\begin{enumerate}
    \item \textbf{Repository to install Autopsy debian package:} To provide more flexibility for the Autopsy end-users an automated repository was created to build Autopsy packages for Debian linux distribution.
    \item \textbf{Repository to use Android Emulator with Docker:} To provide more easy access to an Android machine, a docker image was created with the Android emulator configured and ready to use.
    \item \textbf{Deepening existing knowledge about GBoard:} Available information about GBoard internal structure is very superficial as it only covers a few internal parts.
    \item \textbf{Development of GBoard Forensics standalone application:} A standalone application was created to help extracting forensic information from GBoard application data.
    \item \textbf{Creation of an Autopsy data source module:} With cooperation with the standalone application, an Autopsy data source module was created to integrate the data fetched.
    \item \textbf{Creation of an Autopsy report module:} With cooperation with the standalone application, an Autopsy data source module was created to report and visualized the data fetched.
\end{enumerate}
\end{justify}

\section{Document Structure}

\begin{justify}
In Chapter \ref{ch:concepts-and-technologies} the concept of Digital Forensics is briefly described and presented the used technologies such as D programming language, SQLite and Android.
\end{justify}

\begin{justify}
In Chapter \ref{ch:gboard} GBoard is briefly described with a user's perspective analysis and comparison with other applications. Some tested versions for use in this project are listed and the internal structure is described in detail, such as internal databases and other relevant files. Some rearranged data was also described.
\end{justify}

\begin{justify}
In Chapter \ref{ch:autopsy} the Autopsy digital forensic software is briefly presented, focusing on its main characteristics and functionalities. It also details on one of our contribution to Autopsy with a Linux package for both Arch Linux and Debian distributions.
\end{justify}

\begin{justify}
In Chapter \ref{ch:module} it is described the developed GBoard standalone application called GBoard4A, the integration with Autopsy digital forensics software and the development of two modules for Autopsy. Some results were also presented and discussed.
\end{justify}

\begin{justify}
In Chpater \ref{ch:conclusion} some conclusions were made and presented some aspects to improve and work in the future.
\end{justify}