Authors: Abdus Satter, Shishir Panta, Ibrahim Baggili, Uju E. Okoye
DFRWS APAC 2026
Abstract
Android secure-deletion applications claim to erase files and reduce forensic recoverability, but their own execution can leave residual evidence about app use, selected methods, and targeted files. Yet investigators lack a structured workflow for detecting, timing, and interpreting these traces across different access conditions and lifecycle phases. We present CleanerScope, an access-aware and phase-based forensic pipeline that separates artifact acquisition from artifact interpretation by collecting rooted and non-rooted evidence across four lifecycle phases (baseline, post-wipe, post uninstall, and post-reboot), then correlating dynamic artifacts, persisted system traces, app-private storage, runtime logs, and static code analysis. We evaluate CleanerScope on nine Android wiping applications using a controlled dataset of 58 files, scripted adb acquisition, and static analysis with JADX. App use remained detectable across all nine applications, with usage_stats providing the most durable evidence for detection and timeline reconstruction. Rooted acquisition was required for app-specific method selectors, structured reports, and DataStore files, while non-rooted acquisition still supported detection and timing. Method evidence ranged from direct strings to coded selectors requiring static mapping, and seven of nine applications preserved exact filenames or paths in post-wipe artifacts. Physical-device validation on Android 14 across three applications reproduced these patterns, confirming that CleanerScope provides a reproducible workflow for recovering forensically probative evidence across access levels, lifecycle phases, and device environments.