Mobile Forensic for Body Shaming Investigation Using Association of Chief Police Ofﬁcers Framework

Body shaming is the act of making fun of or embarrassing someone because of their appearance, including the shape or form of their body. Body shaming can occur directly or indirectly. MOBILEdit Forensic Express and Forensic ToolKit (FTK) Imager are used to perform testing of evidence gathered through Chat, User ID, Data Deletion


INTRODUCTION
The advancement of Internet technology is rapid. The total number of internet users in cyberspace has surpassed 3.8 billion [1]. People may access the internet from anywhere, including on smartphones. Smartphones have now become a daily must for everyone [2]. Smartphone use has become a lifestyle need in Indonesia, which has a total population of 274.9 million in 2021 [3,4]. Mobile phones now include an operating system that allows them to perform various duties similar to a personal computer, including internet connectivity. An Android smartphone is a hybrid device that functions as both a telephone and a computer but in a more portable form [5]. Smartphones, which have a variety of functionalities, can be exploited as cybercrime instruments [6]. The advancement of information and communication technology affects every aspect of life. Currently, mobile phones have numerous advantages and intriguing characteristics, the most prominent of which is the use of communication and life in cyberspace or online, namely social media [7]. There are numerous consequences to using social media, including cyberbullying [8]. In terms of Ì 653 Digital Forensics Research Workshop Method, Further investigation was conducted using Michat objects and the DFRWS approach with MOBILedit Forensic Express Pro tools, DB Browser For SQLite, and Oxygen Forensic Detective. A comparison was conducted to evaluate the capabilities of three forensic programs with varying processing levels in acquiring evidence: MOBILedit Forensic Express Pro (66.7%), DB Browser For SQLite (33.3%), and Oxygen Forensic Detective (83%). In litigation, digital evidence can be used as confirming evidence.
Unlike previous research, the forensic process was carried out using the DFRWS Framework [23,24]. While the objects in previous research were WhatsApp [21,22], Signal Messenger [23], and Michat [24]. This research is limited to text messaging (chats), user ID, erasing data, and groups and focuses on the IMO Messenger with the ACPO Framework. The primary goals of this study are to 1) perform digital forensic simulations using the ACPO framework and two tools, MOBILEdit Forensic Express and FTK Imager. 2) Search for digital evidence of body shaming incidents on the IMO Messenger app. This study focuses on digital evidence derived from instant messages.
This article is structured as follows: Part 1. Introduction, which includes a distinction from previous studies, section 2. Research Methods, which discusses the ACPO Framework for obtaining the expected research results, section 3. Results and analysis, which describes the research analysis results using the ACPO framework on IMO Messenger, use the MOBILEdit Forensic Express and FTK Imager tools, section 4. The conclusion summarizes the research findings and provides recommendations for further research.

RESEARCH METHOD
This study simulates digital forensic investigation. A simulation of digital forensic research focuses on investigating and finding the contents of digital devices and related computer crimes. Body shaming cases were the subject of case study-style digital forensic research simulations. Stages of forensic investigation utilize the ACPO framework in digital forensic simulation research. This study aims to forensic examine the Android smartphone software IMO Messenger. MOBILedit Forensic and FTK Imager are the forensic software programs used in this study. Figure 1 shows the steps of the research. Following is a description of each stage of the research process. First is the literature review phase, which starts with gathering prior study data from different sources as a reference. Google Scholar, ResearchGate, and Science Direct were used to conduct literature searches on these websites. The terms Cybercrime, ACPO Framework, Mobile Forensics, Internet Messaging, Digital Forensics, and Body Shaming were used in the search process. Information for literature reviews is gathered from works published in reputable national and international publications. Articles from the past five years are those that are used. Investigations into Androidbased devices can use earlier work in the fields of mobile forensics and the ACPO framework. The introduction and research methods section contains the literature review used as a study source.
The next case is a simulation step. Case simulation is developed at this stage. The study was started by carrying out a case simulation according to the previously designed case scenario shown in Figure 3. An Android device was used to carry out the ISSN: 2476-9843 case simulation, namely the victim's smartphone. Based on this research case study, the perpetrator was arrested with an Android smartphone which was used as evidence. Smartphones will be checked to see if there is any relevant digital evidence. A laptop with MOBILedit Forensic and FTK Imager tools was used for the investigation.
The third stage is forensic analysis. At this stage, the ACPO framework is used to assess the simulation data. Our research concentrates on text messages, user ids, deleted data, and groups to help with the search for digital evidence. The following are some of the variables sought in this study. The MOBILEdit Forensic and FTK Imager tools are used to identify research variables in the forensic analysis process. Analysis of forensic results is the last step, and the investigator examines the forensic findings.

Framework
The ACPO framework is used in this study to search for digital evidence in the form of text messages, user IDs, deleted data, and groups in four stages: Plan, Capture, Analyze, and Present. The ACPO framework was used to conduct this research. Figure 2 illustrates the four processes that must be completed to achieve good research results.

Plan
The planning phase starts with determining the hardware and software required for the research process in order to get research results. The planning process begins with determining the tools and research materials; research tools might be hardware or software, and their respective applications have been identified.

Capture
This is the step in which all of the study results are recorded, stored, captured, and collected. Process capture on the results of the research process can make use of existing software as well as assistance hardware. The research will uncover data that can be used as evidence that there is no wrongdoing.

Analysis
This is the step in which all of the study results are recorded, stored, captured, and collected. Process capture on the results of the research process can make use of existing software as well as assistance hardware. The research will uncover data that can be used as evidence that there is no wrongdoing.

Present
At this stage, an explanation of all actions carried out during the study is carried out and discussed in full the outcomes of the research and provides input or ideas linked to the study's conclusions.

Research Tools
Tools are now needed for this project in order to collect artifacts from the IMO Messenger program. There are two types of research tools: forensic software and hardware. The research materials utilized in this experiment are described in detail in Table 1 A method used to transmit digital data from a smartphone to a storage device so that it can be analyzed USB Used to provide access from a smartphone and connect it to a computer Smartphone Used to store digital evidence data KingRoot Used to root the smartphone MOBILedit Forensic Express Used for the IMO Messenger application in the smartphone physical imaging process or data backup FTK Imager Used to carry out testing of digital evidence without changing the data or metadata of the original evidence

Case Simulation
Simulation is utilized to collect the data required for the study's sample. Conversations in an instant messaging group are used to carry out the simulation. One of the group members became a victim of bullying. At this point, the researcher does mobile forensics, which uses ID numbers to look for criminals and serves as the foundation for retrieving an analysis report from a database. The method employed in this study involves retrieving conversational data from the victim's Imo database, which will then be further analyzed utilizing the MOBILEdit Forensic Express application as a tool to look for evidence in the form of chat and perpetrator id. a brief explanation of the mobile forensic workflow applied to the Figure 3; the scenario of a criminal investigation on the IMO instant messaging platform. The process of finding evidence will next be examined using the tools MOBILEdit Forensic Express and FTK Imager, which will offer data in the form of previously recorded conversations in the database. In Figure 3, a case simulation was performed using a fictional group of teenage friends who regularly communicate on the IMO Messenger program in a group chat. However, one of them received a summons that referred to "you are really fat right now" and other forms of body shaming, which caused the victim to complain and report it to the police. The investigator uses the victim's smartphone to perform an inquiry, and they receive the report's findings. The investigator constructed a scenario for this investigation. The scenario is a cyberbullying instance involving multiple attackers and one victim. In this case, the victim and the perpetrators had a chat that resulted in cyberbullying against the victim via the IMO Messenger application. As the victim's smartphone, a Samsung Galaxy Core 2 was used in this scenario.

RESULT AND ANALYSIS
This section will review how to use the Association of Chief Police Officers framework in IMO Messenger forensics.

Plan
This flow begins with preparing a plan outlining the stages to be taken in the research process, including creating scenarios and preparing research tools and materials. In this stage, a search, data collection, and documentation of evidence is carried out in the form of the victim's smartphone, according to the predetermined scenario. The evidence is alive, and the security feature is not active. At this stage, documentation related to the evidence is carried out. Documentation of evidence can be seen in Figure 4. The next step is to turn on Airplane mode to separate the evidence from the internet connection. Avoiding damaging evidence on the smartphone is the goal of Airplane Mode, then switch on the smartphone's Development Options feature. To prevent the smartphone from going into sleep mode if it is not used for a time, the Stay Awake and USB Debugging options must also be enabled. Sleep mode serves to stop smartphone devices from activating the security system during the forensic procedure. Figure 5 depicts the evidence isolation stage.  Table 1 depicts the investigation of the instruments and materials utilized in forensic analysis.  Table 2 shows the instruments utilized, which comprise an Acer Aspire E 14 core i3 laptop, a Samsung Galaxy Core 2 smartphone, and a USB connector. The IMO Messenger program, MOBILEdit Forensic Express, and FTK Imager tools are used to support this forensic research. The smartphone must first be rooted to extract data from an Android device. The Imo application messenger, which is attached to the physical evidence, will evaluate the digital evidence utilizing the following investigation techniques on the evidence: 1. A smartphone running the Android operating system was purchased from the incident scene. 2. Isolation or signal coverage is turned off, and airplane mode is engaged. 3. By connecting to a laptop or PC with the ACER brand, MOBILEdit Forensic is used to back up smartphone evidence. 4. The MOBILEdit Forensic tool Express and FTK Imager are used for extraction and analysis.

Capture
Capture is the process of storing or documenting all digital data obtained during the acquisition phase. The data is then classified according to its type. Because all forensics techniques utilized were able to gather, text chat and user Ids were the best results for confirming digital evidence data. Chat messages and user Ids are the most crucial and key data points for cyberbullying cases.  Figure 6 shows the output of a comprehensive report generated by the MOBILEdit Forensics Express tool. Then various reporting files in these outcomes will be employed as digital data. MOBILEdit Forensics Express is capable of logical as well as physical acquisition. MOBILEdit Forensics Express is capable of extracting data from smartphone devices. MOBILEdit Forensic Express can recognize a cell phone's International Mobile Equipment Identity (IMEI) and a registered SIM card's IMSI and Integrated Circuit Card Identifier (ICCID). MOBILEdit successfully obtained contact information, text messages, and group data.   Figure 9 shows the outcome of the imaging results file recovered with the FTK Imager, which is the discussion between the criminal and the victim. However, because the conversations generated by data extraction are still scrambled, they must be found manually.
The extraction of text message data from the IMO Messenger application utilizing MOBILEdit Forensic Express and FTK Imager was successful. The outcomes of the extraction process were then evaluated. The digital data discovered in the analysis procedure in the form of text messages demonstrates that MOBILEdit Forensics Express and FTK Imager can gather digital data from the IMO Messenger program.

Analysis
The following Table 2 contains IMO Messenger data that was used in the study. This stage involves the examination and processing of the data obtained through the examination process, followed by an investigation to obtain or discover proof of the required items, namely the Imo database kept on the smartphone device storage without affecting the integrity of the data.  The file structure that was extracted using the FTK Imager program is shown in Figure 11. The com.imo file found in the evidence is displayed by the FTK Imager program as the necessary database.

Present
This flow shows the evidence that was successfully acquired after the previous stages. The mobile forensic process and the ACPO flow on the Android platform were discovered to be capable of obtaining digital artifacts linked to the required evidence. These artifacts include conversations, User IDs, Data Delete, and Groups. In this study, the researchers focus exclusively on studying recorded and stored conversations in the database. Based on the testing findings, the index number formula determines each forensic tool's performance. The equation shows how the index number was calculated using an unweighted index.
Explanation: P ar = Forensic tool accuracy index number. ar0 = number of detected variables. arT = Total number of variables used [23].
ISSN: 2476-9843 Table 3 shows the analysis results based on the conclusions collected through digital evidence. Since it can only locate three of the four digital evidence parameters sought by the MOBIL edit Forensic Express tool's equation, its performance value is only 0.75%. The FTK Imager, nevertheless, has a performance value of 0.25% since it can only locate one of the four characteristics of digital evidence. The following formula can be used to obtain the performance value needed to gauge each forensic tool's potential.

MOBILedit Forensic Express
FTK Imager: The evidence extraction is in Table 3 illustrates that the MOBILEdit Forensic and FTK Imager tools can discover the digital chat evidence you are looking forthe total findings of the evidence forensic process for the Samsung Galaxy Core 2 android smartphone. The evidence discovered at the scene of the occurrence includes both digital and physical evidence. The victim's smartphone was discovered as physical evidence. Furthermore, an investigative process is carried out on the victim's smartphone to acquire digital evidence. Table 3 is the outcome of obtaining digital evidence using percentages. The overall findings of the forensic process for the evidence of the Samsung Galaxy Core 2 android smartphone after the stages were completed following the ACPO method step technique utilized for research. A comparison of research results obtained in other studies using the ACPO framework can be seen in Table 4. In Table 4, research conducted by Kurniadin Abd. Latif et al. [25] titled Forensic Whatsapp Investigation Analysis on Bluestack Simulator Device Using Live Forensic Method with ACPO Standard. Based on research, WhatsApp with the tools Bluestack, FTK Imager, Whatsapp Viewer, and SQLite. The findings of this investigation demonstrate that forensic analysis on Android devices using the Bluestacks simulator can be carried out following ACPO guidelines. Fitri Anggraini et al. [26] conducted research on the title Forensic Analysis of the TikTok Application on Android Smartphones Using the Association of Chief Police Officers Framework with the tool Magnet Axiom. The Magnet Axiom forensics software and the ACPO forensics framework are combined in this study. Together, they generated 77% of the proof through data messages, videos, and hashtags, in cases where these data were previously specified as initial data posted throughout the simulation procedure. Ermin et al. [27] researched Forensic Analysis of Dana Applications Using the ACPO Framework. Based on the research, the forensic analysis results were obtained using two forensic tools, Belkasoft Evidence Center and MobilEdit Express Pro Forensic Tools, and both failed to find artifacts that could be used as digital evidence. Compared with previous research, this research uses MOBILEdit Forensic and FTK Imager tools to search for digital evidence. Previous research did not use many tools to obtain information about the object to be tested.

CONCLUSION
According to the research findings of the Application of the Association of Chief Police Officers Framework for Body Shaming analysis Using the MOBILEdit Forensic Express tools, it has a 0.75% extraction percentage, and FTK Imager has a 0.25% extraction percentage. The findings of this study can be used as a resource for future studies; it is believed that the usage of forensic tools will become more diverse with the latest editions, allowing for the collection of additional digital artifacts from the IMO Messenger application. MOBILEdit Forensic gets more digital evidence, while FTK Imager only gets text messages and has to be searched manually. For future research, the researcher suggests studying mobile forensic techniques and frameworks and using other forensic instruments with recent updates to expect them to produce more precise results when collecting digital evidence.

ACKNOWLEDGEMENTS
Thank you to the Ahmad Dahlan University MTI Study Program for facilitating the Research Laboratory to complete the research.

DECLARATIONS
AUTHOR CONTIBUTION This study was compiled by three authors divided into their respective tasks. Yana Safitri compiles and designs work, collects, analyzes, and interprets data. Imam Riadi and Sunardi as supervisors for articles to be published.

FUNDING STATEMENT
This study received no specific financing from any funding agency in the public, commercial, or non-profit sectors.