A FORENSIC ANALYSIS OF VIDEO STREAMING ACTIVITIES ON ANDROID APPLICATIONS

Mobile applications of video streaming platforms store a lot of information on mobile devices which can have both positive and negative impacts. Positive, in the sense that it could assist law enforcement agencies in solving crime, and the negative impact is that it could be accessed by malicious actors. In this study, we forensically investigate the Netflix, Amazon Prime Video, and iFlix android applications. The major focus is on identifying stored artifacts on the mobile devices left behind by the android video streaming applications. It will give law enforcement agencies and forensic investigators a clear direction when it comes to extracting evidence to solve a crime. On the other hand, it will notify the mobile application developers on how to further improve the security of their mobile applications.


INTRODUCTION
The past decade has seen a major shift in electronic media, especially in the entertainment sector [1]. Now, more people are consuming content through digital media, which was earlier being viewed via electronic media [2]. This has given rise to online video streaming platforms which allow users to view content at the time of their convenience as opposed to electronic media where the transmission has a set schedule [3]. Initially, these platforms could only be accessed through their web-based applications, but over time, mobile applications were also developed for these video streaming platforms [4]. These applications tend to store personal information and also leave behind remnants of the activities performed even after the application has been uninstalled [5]. These remnants need to be examined to verify whether they violate the privacy of the user [6]. In the scenario where malicious actors gain access to the mobile device of a user, it can prove detrimental for the user [7]. Furthermore, they can also aid in investigations where the law-enforcing authorities need to cross-check the alibi of the suspects [8]. A very common use case for this can be a road accident where the law enforcement agencies can prove that the suspect was viewing a video on one of these platforms. In this study, we will examine the video streaming applications. For this we selected the three most popular video streaming platforms which are Netflix, Amazon Prime Video, and iFlix. Amongst the three, Netflix is the most popular and has been present for the longest time. The goal is to present the artifacts left behind the applications along with the path to their location claims made by the TOR Project as the researchers were able to retrieve significant artifacts that revealed details about the user's browsing activities.

Proposed Method
The proposed research methodology is shown in figure 1. We start with rooting the device, then we install the desired application either through Google Play Store or through an APK downloaded from the internet. Next, we perform the required activities on the application and take the physical image of the mobile device. Finally, we examine, analyze and report our findings. This workflow was repeated for all the 3 android applications which were a part of this research project.

Fig. 1 Methodology of this Research
The following activities were performed individually on all the 3 applications and a physical image was taken after each activity was successfully conducted: Following are the codes for the above-mentioned groups of activities:

1) Netflix
Netflix is the oldest and most popular online video streaming platform [15]. It can be accessed both on the web and through mobile device applications [16]. The company was formed in 1997 when it operated as a DVD rental business. It began its online streaming services in 2007 and ever since then it has seen tremendous success and growth. As of the year 2020, Netflix has over 200 million paid subscribers [17]. Netflix is also available on android mobile devices where it has over a billion downloads. In order to subscribe to the streaming platform, we need to purchase the subscription via a debit or credit card. There are multiple subscription plans available depending upon your requirements. The cheapest plan only allows you to view the content on your smartphones and tablets in 480p resolution, whereas the most expensive allows you to watch on any device with resolutions up to 4k. The analysis of this application is based on its version 8.6.0, whose APK is available online at the following link: www.apkmirror.com. The following remnants were discovered concerning the activities performed along with the path to their location.

2) Amazon Prime Video
Amazon Prime Video was launched in the year 2006 as an online video streaming service [18]. Later its mobile applications were also released. Currently, it has over 175 million users and its android application has over 100 million downloads. Amazon Prime Video is available in over 200 countries worldwide [19]. Upon subscription, Amazon Prime Video offers you a one-week trial period during which you can cancel the subscription and you will not be charged for it. You can subscribe through the android application by using your credit card or through the google play store payments feature [20]. The analysis of Amazon Prime Video's android application is based on its version 3.0.308.15647, which is the latest version available on the google play store as of now.
The following remnants were discovered concerning the activities performed along with the path to their location.

3) iFlix
iFlix is one of the more recent entrants in the market of online video streaming platforms [21]. It was launched in the year 2014 and it primarily catered the Asian market with most of its content originating from China and Korea. As of 2020, iFlix has over 25 million active users and its android application has been downloaded over 50 million times. Some of the features on this platform are free of cost while for others you have to subscribe to its service. You can view and download the initial episodes for free for most of the TV Shows currently hosted by iFlix, however to for later episodes you need to be a paid subscriber. The analysis of the android application of iFlix is based on its version 4.6.6.603590720, which is the latest version available on google play store as of now.
The following remnants were discovered concerning the activities performed along with the path to their location.

Conclusion
Our results included several artifacts with great forensics value. These contained the account information of the user who downloaded the application, information about the application such as its package name and version. More importantly, we could exactly state the timestamps between which a user was viewing a video. This helps in reliably formulating the timeline of activities of the suspect should he be involved in any criminal activity such as a car accident. Furthermore, artifacts related to downloading a video were also found. The artifacts, apart from having forensic value, also pose a privacy risk. As so much information related to the user is stored on the mobile device, it can prove detrimental to the user should the mobile device be accessed by malicious actors. Mobile application developers should limit the amount of information stored on the mobile devices and try to encrypt it as much as possible.

Future Work
In our research project, we tried to as comprehensive as possible given our constraints. However, due to limitations of time and technology there still remains potential for future work in this domain. The focus of our study was on the physical image of the device storage and in the future people can work on acquiring the volatile memory when an application is running to study the artifacts present in it. Secondly, we carried our research on android based applications as this is the more popular mobile OS, however, a similar study can be conducted on iOS based video streaming applications and the artifacts can be compared with those collected from android applications to formulate a comparative study. Finally, this study was conducted on the most popular video streaming platforms globally and in the future researchers can focus on the local alternatives of these applications.