Evaluation of Commercial Mobile Forensic Tools for Android Evidence Extraction in Digital Forensic Investigations

Android smartphones are the major source of digital evidence in forensic investigations. However, different device models and operating systems make reliable data extraction challenging during forensic examination. This study evaluates comparative end-to-end artifact recovery from three commercial mobile forensic tools across different Android devices. Twenty Android smartphones of different makes and models were examined using Cellebrite UFED, MSAB XRY and Oxygen Forensic Detective. For each device-tool combination, the highest supported acquisition method available at the time of examination was used. The extracted artifacts were classified as call logs, contacts, chats, emails and multimedia. Tool performance was evaluated using dominance frequency analysis and pairwise Wilcoxon SignedRank Tests. Oxygen Forensic Detective achieved the highest call log and chat artifact counts in 16 and 17 of the 20 devices, respectively. Cellebrite UFED extracted the highest contact count in 12 of the devices, whereas MSAB XRY achieved the highest number of emails and multimedia files on 17 and 16 devices, respectively. Pairwise Wilcoxon testing identified statistically significant differences in several tool comparisons, although not all comparisons were significant. No single forensic tool consistently achieved the highest artifact recovery across all categories. The findings suggest that Android forensic extraction is device- and artifact-dependent. The count-based dominance should be interpreted as end-to-end recovery performance rather than as direct evidence of forensic accuracy or completeness.