Mobile Forensic Investigation of E-Commerce Fraud Using DFRWS Method and Perceptual Hashing

Rizal Prambudi; Imam Riadi; Murinto Murinto

doi:10.30595/juita.v14i1.27690

Authors

Rizal Prambudi Universitas Ahmad Dahlan
Imam Riadi Universitas Ahmad Dahlan
Murinto Murinto Universitas Ahmad Dahlan

DOI:

https://doi.org/10.30595/juita.v14i1.27690

Keywords:

Mobile device analysis; e-commerce; DFRWS; perceptual hash; digital criminal activity.

Abstract

Social media platforms have enabled real-time communication and broad user interaction, but they are often exploited for cybercrime. One such vulnerable medium is e-commerce applications, which facilitate transactions and store sensitive user data. This study investigates digital evidence in a simulated fraud case involving an e-commerce application by applying mobile forensic techniques guided by the Digital Forensic Research Workshop framework. The investigation focused on recovering user accounts, text messages, images, and videos from an Android smartphone. Two forensic tools Oxygen Forensic Detective and MOBILedit Forensic Express were used for data extraction and analysis. To improve the reliability of visual evidence, the study incorporated perceptual hashing and wavelet hashing techniques to validate compressed image files. The results showed that Oxygen Forensic Detective recovered 71.4% of digital evidence, while MOBILedit achieved 57%. Although both tools successfully recovered multimedia files, Oxygen performed better in extracting text messages. These findings demonstrate the effectiveness of mobile forensic methods in identifying and validating digital evidence in e-commerce fraud cases. Moreover, integrating the DFRWS methodology with perceptual hashing significantly improves the interpretation of manipulated or compressed images, thus enhancing the evidentiary value for legal proceedings.

Author Biographies

Rizal Prambudi, Universitas Ahmad Dahlan

Department of Informatics

Imam Riadi, Universitas Ahmad Dahlan

Department of Information System

Murinto Murinto, Universitas Ahmad Dahlan

Department of Informatics

References

[1] Kementerian Perdagangan Republik Indonesia, “Statistik Perdagangan E-Commerce 2023,” 2023. Accessed: Aug. 03, 2025. [Online]. Available: https://www.kemendag.go.id/

[2] DataIndonesia.id, “Jumlah Pengunjung Shopee Indonesia Q2 2022.” Accessed: Aug. 03, 2025. [Online]. Available: https://dataindonesia.id

[3] I. Riadi, Herman, and N. H. Siregar, “Mobile Forensic Analysis of Signal Messenger Application on Android using Digital Forensic Research Workshop (DFRWS) Framework,” Ingenierie des Systemes d’Information, vol. 27, no. 6, pp. 903–913, Dec. 2022, doi: 10.18280/ISI.270606.

[4] I. Riadi, A. Yudhana, and Galih Pramuja Inngam Fanani, “Comparative Analysis of Forensic Software on Android-based MiChat using ACPO and DFRWS Framework,” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 7, no. 2, pp. 286–292, Mar. 2023, doi: 10.29207/resti.v7i2.4547.

[5] R. Prambudi, I. Riadi, and Murinto, “Analisis Forensik Mobile pada Aplikasi E-Commerce Menggunakan Metode Association of Chief Police Officers: Mobile Forensic Analysis Of E-Commerece Applications Using The Association Of Chief Police Officers Method,” Cyber Security dan Forensik Digital, vol. 8, no. 1, pp. 44–52, Jun. 2025, doi: 10.14421/csecurity.2025.8.1.5234.

[6] K. Lakshmi, P. Honnavalli, and S. Rajashree, “Ensure the Validity of Forensic Evidence by Using a Hash Function,” Singapore: Inventive Communication and Computational Technologies, vol 145. Springer, Singapore., Jan. 2021, pp. 341–346. doi: 10.1007/978-981-15-7345-3_28.

[7] M. Hema and S. P. Shyry, “Efficient Compression of Multimedia Data using Lempel–Ziv–Markov Chain Adaptive Block Compressive Sensing (LZMC-ABCS),” Wirel Pers Commun, vol. 135, 2024, doi: 10.1007/s11277-024-11187-z.

[8] M. Muammar, I. Riadi, and R. Umar, “Mobile Forensics in Human Trafficking Investigation Services Using Mobile Laboratory,” JUITA: Jurnal Informatika, vol. 13, no. 1, pp. 1–10, Mar. 2025, doi: 10.30595/juita.v13i1.24060.

[9] D. Setiawan and I. Riadi, “Mobile Forensic WhatsApp Services in Online Fraud Cases using Digital Forensic Research Workshop Methods,” Int J Comput Appl, vol. 186, no. 34, pp. 49–56, Aug. 2024, doi: 10.5120/ijca2024923908.

[10] M. Moreb, M. Shadeed, S. Younis, and A. Khalil, “Mobile Forensic Investigation for WhatsApp,” in Practical Forensic Analysis of Artifacts on iOS and Android Devices: Investigating Complex Mobile Devices, Berkeley, CA: Apress, 2022, pp. 281–328. doi: 10.1007/978-1-4842-8026-3_9.

[11] L. Twenning, H. Baier, and T. Göbel, “Using Perceptual Hashing for Targeted Content Scanning,” IFIP Adv Inf Commun Technol, vol. 687 AICT, pp. 125–142, 2023, doi: https://doi.org/10.1007/978-3-031-42991-0_7.

[12] M. Offtermatt, M. R. Kilidjian, and L. McGuiness, “Future-proofing Metadata at Los Alamos National Laboratory,” in Proceedings of the International Conference on Dublin Core and Metadata Applications, Dublin Core metadata initiative, 2024. doi: 10.23106/dcmi.952460454.

[13] S. Sharma, “Analysis of Perceptual Hashing for Threshold Values,” Procedia Comput Sci, vol. 260, pp. 1107–1112, Jan. 2025, doi: 10.1016/J.PROCS.2025.03.295.

[14] M. Alkhowaiter, K. Almubarak, and C. Zou, “Evaluating Perceptual Hashing Algorithms in Detecting Image Manipulation Over Social Media Platforms,” in 2022 IEEE International Conference on Cyber Security and Resilience (CSR), 2022, pp. 149–156. doi: 10.1109/CSR54599.2022.9850288.

[15] U. S. D. of H. Security, “Test Results for Mobile Device Acquisition Tool: Oxygen Forensic Detective v17.1.0.131,” NIST Computer Forensics Tool Testing (CFTT) Program, United States, May 2025. Accessed: Aug. 03, 2025. [Online]. Available:https://www.dhs.gov/sites/default/files/202505/25_0501_st_test_results_for_mobile_device_acquisition_tool_oxygen_forensic_detective_v17.1.0.131.pdf

[16] R. M. Abou-Elzahab, M. F. Al Rahmawy, and T. T. Hamza, “Comparative Study of Different Mobile Forensic Tools for Extracting Evidence from Android Devices,” Mansoura Journal for Computer and Information Sciences, vol. 16, no. 1, pp. 1–12, 2020, doi: 10.21608/mjcis.2020.321070.

[17] T. Sutikno and I. Busthomi, “Power of analytic tools in Oxygen Forensic ® Detective based on NIST cybersecurity framework,” Computer Science and Information Technologies, vol. 6, no. 1, pp. 8–19, 2025, doi: 10.11591/csit.v6i1.pp8-19.

[18] F. Breitinger, J.-N. Hilgert, C. Hargreaves, J. Sheppard, R. Overdorf, and M. Scanlon, “DFRWS EU 10-Year Review and Future Directions in Digital Forensic Research,” Forensic Science International: Digital Investigation, vol. 48, p. 301685, 2024, doi: https://doi.org/10.48550/arXiv.2312.11292.

[19] Y. Jia, C. Cui, and A. A. A. El-Latif, “Robust Image Hashing Using Histogram Reconstruction for Improving Content Preservation Resistance and Discrimination,” Symmetry (Basel), vol. 15, no. 5, May 2023, doi: 10.3390/sym15051088.

[20] S. McKeown, P. Aaby, and A. Steyven, “PHASER: Perceptual hashing algorithms evaluation and results - An open source forensic framework,” Forensic Science International: Digital Investigation, vol. 48, p. 301680, Mar. 2024, doi: 10.1016/J.FSIDI.2023.301680.

[21] H. Mareen, N. Van Kets, P. Lambert, and G. Van Wallendael, “Fast fallback watermark detection using perceptual hashes,” Electronics (Switzerland), vol. 10, no. 10, May 2021, doi: 10.3390/electronics10101155.

[22] A. F. Akbar, P. D. W. Ayu, and D. P. Hostiadi, “Performance Analysis of Deep Learning Architectures in Classifying Fake and Real Images,” JUITA: Jurnal Informatika, vol. 13, no. 2, pp. 167–176, Aug. 2025, doi: 10.30595/juita.v13i2.25790.

[23] S. McKeown and W. J. Buchanan, “Hamming distributions of popular perceptual hashing techniques,” Forensic Science International: Digital Investigation, vol. 44, Mar. 2023, doi: 10.1016/j.fsidi.2023.301509.

[24] A. Alyas, A. Ahmed, and V. Kumar, “Lawfully Data Collection Techniques in Mobile Forensic & Analysis Using Cellebrite Physical Analyzer,” in Proceedings of the KILBY 100 7th International Conference on Computing Sciences 2023 (ICCS 2023), May 2023. doi: 10.2139/ssrn.4483864.

[25] H. Syahida Alawi, I. Riadi, and S. Sunardi, “Improving Credibility of Digital Evidence Investigation in E-Commerce Fraud Cases using ISO/IEC 27037,” International Journal of Advances in Data and Information Systems, vol. 6, no. 2, pp. 479–495, doi: 10.59395/ijadis.v6i2.1408.

[26] S. Almotiri, Forensic Hash Value Guidelines: Why Md5 and SHA1 should no longer be used and a recommendation for their replacement. Auckland University of Technology, 2022.

[27] M. D. Cicchini, “The Daubert Double Standard,” Feb. 2021, Social Science Research Network. Accessed: Dec. 15, 2025. [Online]. Available: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3787772

[28] P. Samanta and S. Jain, “Analysis of Perceptual Hashing Algorithms in Image Manipulation Detection,” Procedia Comput Sci, vol. 185, pp. 203–212, 2021, doi: https://doi.org/10.1016/j.procs.2021.05.021.

[29] Y. Jakhar and M. D. Borah, “Effective near-duplicate image detection using perceptual hashing and deep learning,” Inf Process Manag, vol. 62, no. 4, p. 104086, 2025, doi: https://doi.org/10.1016/j.ipm.2025.104086.