{"id":"https://openalex.org/W4411949074","doi":"https://doi.org/10.1109/access.2025.3585096","title":"Emulator Forensics Investigation Model (EFIM)","display_name":"Emulator Forensics Investigation Model (EFIM)","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4411949074","doi":"https://doi.org/10.1109/access.2025.3585096"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3585096","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3585096","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3585096","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114104175","display_name":"Sedat \u015een","orcid":"https://orcid.org/0000-0001-6322-5483"},"institutions":[{"id":"https://openalex.org/I66514158","display_name":"Hacettepe University","ror":"https://ror.org/04kwvgz42","country_code":"TR","type":"education","lineage":["https://openalex.org/I66514158"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Sedat \u015een","raw_affiliation_strings":["Department of Forensic Sciences, Institute of Science, Hacettepe University, Ankara, Türkiye","Department of Forensic Sciences, Institute of Science, Hacettepe University, Ankara, Turkey"],"raw_orcid":"https://orcid.org/0000-0001-6322-5483","affiliations":[{"raw_affiliation_string":"Department of Forensic Sciences, Institute of Science, Hacettepe University, Ankara, Türkiye","institution_ids":["https://openalex.org/I66514158"]},{"raw_affiliation_string":"Department of Forensic Sciences, Institute of Science, Hacettepe University, Ankara, Turkey","institution_ids":["https://openalex.org/I66514158"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023938669","display_name":"Harun Artuner","orcid":"https://orcid.org/0000-0002-6044-379X"},"institutions":[{"id":"https://openalex.org/I66514158","display_name":"Hacettepe University","ror":"https://ror.org/04kwvgz42","country_code":"TR","type":"education","lineage":["https://openalex.org/I66514158"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Harun Artuner","raw_affiliation_strings":["Department of Computer Engineering, Faculty of Engineering, Hacettepe University, Ankara, Türkiye","Department of Computer Engineering, Faculty of Engineering, Hacettepe University, Ankara, Turkey"],"raw_orcid":"https://orcid.org/0000-0002-6044-379X","affiliations":[{"raw_affiliation_string":"Department of Computer Engineering, Faculty of Engineering, Hacettepe University, Ankara, Türkiye","institution_ids":["https://openalex.org/I66514158"]},{"raw_affiliation_string":"Department of Computer Engineering, Faculty of Engineering, Hacettepe University, Ankara, Turkey","institution_ids":["https://openalex.org/I66514158"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I66514158"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":2.0267,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.87776572,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"13","issue":null,"first_page":"134189","last_page":"134211"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9934999942779541,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6756256222724915}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6756256222724915}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3585096","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3585096","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:67211222adb54b788c53f6b13565209f","is_oa":true,"landing_page_url":"https://doaj.org/article/67211222adb54b788c53f6b13565209f","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 134189-134211 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3585096","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3585096","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Gender equality","id":"https://metadata.un.org/sdg/5","score":0.5799999833106995}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W24678375","https://openalex.org/W198058857","https://openalex.org/W2096127821","https://openalex.org/W2156849122","https://openalex.org/W2384270913","https://openalex.org/W2473446475","https://openalex.org/W2483024783","https://openalex.org/W2532620215","https://openalex.org/W2557698442","https://openalex.org/W2796190275","https://openalex.org/W2964142276","https://openalex.org/W2966320414","https://openalex.org/W2979928150","https://openalex.org/W3021238966","https://openalex.org/W3025740502","https://openalex.org/W3033383572","https://openalex.org/W3041426302","https://openalex.org/W3047777400","https://openalex.org/W3163337607","https://openalex.org/W3175882957","https://openalex.org/W4205841428","https://openalex.org/W4295548217","https://openalex.org/W4300607852","https://openalex.org/W4378531163","https://openalex.org/W4380187195","https://openalex.org/W4382940931","https://openalex.org/W4387723128","https://openalex.org/W4389776419","https://openalex.org/W4392514752","https://openalex.org/W4396939934","https://openalex.org/W4397026232","https://openalex.org/W4399412051","https://openalex.org/W4403882618","https://openalex.org/W4406083987","https://openalex.org/W4409494752","https://openalex.org/W6601015418","https://openalex.org/W6674531144","https://openalex.org/W6682839970","https://openalex.org/W6774272262","https://openalex.org/W6853372162"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Emulator":[0,22,48],"forensics":[1],"has":[2],"become":[3],"critical":[4],"in":[5,191],"combating":[6],"cybercrime,":[7],"providing":[8],"deep":[9],"insight":[10],"into":[11],"digital":[12],"artifacts":[13,129],"generated":[14],"within":[15],"virtual":[16],"environments.":[17],"This":[18,183],"study":[19],"introduces":[20],"the":[21,47,58,123,187],"Forensics":[23,49],"Investigation":[24],"Model":[25],"(EFIM),":[26],"a":[27,52,73,83],"nine-phase,":[28],"platform-agnostic":[29],"forensic":[30,188],"framework":[31],"designed":[32],"to":[33,141,180,198],"guide":[34],"systematic":[35],"investigations":[36],"across":[37],"Android":[38],"emulator":[39,148,194],"platforms.":[40],"To":[41],"implement":[42],"this":[43],"model,":[44],"we":[45],"developed":[46],"Tool":[50],"(EFT),":[51],"lightweight,":[53],"modular":[54,163],"tool":[55],"that":[56],"supports":[57,122],"detection":[59],"and":[60,69,82,100,112,119,147,150,159,171,196],"analysis":[61],"of":[62,126],"widely":[63],"used":[64],"emulators,":[65],"including":[66],"Bluestacks,":[67],"NoxPlayer,":[68],"Waydroid.":[70],"EFT":[71,121,176],"achieved":[72],"48\u00d7":[74],"speed":[75],"improvement":[76],"over":[77],"commercial":[78],"tools":[79],"on":[80,86],"Windows":[81],"7\u00d7":[84],"gain":[85],"Unix":[87],"systems,":[88],"while":[89],"also":[90],"demonstrating":[91],"lower":[92],"RAM":[93],"usage":[94],"(80":[95],"MB":[96],"vs.":[97],"1811":[98],"MB)":[99],"higher":[101],"disk":[102],"I/O":[103],"throughput.":[104],"EFIM":[105],"formalizes":[106],"its":[107],"process":[108],"via":[109],"Set":[110],"Theory":[111],"Finite":[113],"State":[114],"Machines":[115],"(FSMs),":[116],"ensuring":[117],"auditability":[118],"reproducibility.":[120],"binary-level":[124],"extraction":[125],"encrypted":[127],"BLOB":[128],"(e.g.,":[130],"Gmail,":[131],"Telegram),":[132],"enabling":[133],"deferred":[134],"cryptographic":[135],"analysis.":[136,161],"The":[137],"model":[138],"is":[139,151],"resilient":[140],"anti-forensic":[142],"techniques":[143],"such":[144],"as":[145],"timestomping":[146],"fingerprinting":[149],"validated":[152],"through":[153],"controlled":[154],"experiments":[155],"with":[156],"synthetic":[157],"datasets":[158],"statistical":[160],"EFIM\u2019s":[162],"design":[164],"enables":[165],"future":[166],"support":[167],"for":[168],"iOS":[169],"simulators":[170],"game":[172],"emulators.":[173],"All":[174],"non-sensitive":[175],"components":[177],"are":[178],"open-sourced":[179],"promote":[181],"transparency.":[182],"research":[184],"significantly":[185],"enhances":[186],"community\u2019s":[189],"capabilities":[190],"analyzing":[192],"evasive":[193],"environments":[195],"contributes":[197],"legally":[199],"reliable,":[200],"scalable":[201],"investigation":[202],"practices.":[203]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}