Research Article
A Forensic Framework for Android Emulators in macOS Environments within Ad Hoc Network Scenarios
@INPROCEEDINGS{10.1007/978-3-032-38705-9_6, author={Sedat Şen and Harun Artuner}, title={A Forensic Framework for Android Emulators in macOS Environments within Ad Hoc Network Scenarios}, proceedings={Intelligent Transport Systems. 9th EAI International Conference, INTSYS 2025, Marietta, GA, USA, December 10, 2025, Proceedings}, proceedings_a={INTSYS}, year={2026}, month={10}, keywords={emulator forensics macOS forensics MANET AODV OLSR timeline correlation virtualization forensics}, doi={10.1007/978-3-032-38705-9_6} }- Sedat Şen
Harun Artuner
Year: 2026
A Forensic Framework for Android Emulators in macOS Environments within Ad Hoc Network Scenarios
INTSYS
Springer
DOI: 10.1007/978-3-032-38705-9_6
Abstract
Android emulators, widely used for development and testing, are increasingly involved in forensic investigations due to their misuse in device spoofing, credential manipulation, and evidence tampering. However, existing methodologies provide limited guidance for systematically acquiring and analyzing emulator artifacts within Apple’s restrictive macOS ecosystem. This study proposes and validates a macOS-specific forensic framework for Android emulators, focusing on reliable imaging, artifact extraction, and integrity preservation. The framework is experimentally evaluated using Parallels, NoxPlayer, and Genymotion, and incorporates emulator-centric acquisition techniques—including dd, adb, and qemu-img—along with application-level artifact analysis (e.g., WhatsApp, Gmail).