Forensic Analysis of HEIF Files on Android and Apple Devices


KIPS Transactions on Software and Data Engineering, Vol. 10, No. 10, pp. 421-428, Oct. 2021
https://doi.org/10.3745/KTSDE.2021.10.10.421,   PDF Download:
Keywords: H.265, HEIF, HEIC, Motion Photo, Digital Forensics
Abstract

The High Efficiency Image File Format (HEIF) is an MPEG-developed image format that utilizes the video codec H.265 to store still screens in a single image format. The iPhone has been using HEIF since 2017, and Android devices such as the Galaxy S10 have also supported the format since 2019. The format can provide images with good compression rates, but it has a complex internal structure and lacks significant compatibility between devices and software, making it not popular to replace commonly used JPEG (or JPG) files. However, despite the fact that many devices are already using HEIF, digital forensics research regarding it is lacking. This means that we can be exposed to the risk of missing potential evidence due to insufficient understanding of the information contained inside the file during digital forensics investigations. Therefore, in this paper, we analyze the HEIF formatted photo file taken on the iPhone and the motion photo file taken on the Galaxy to find out the information and features contained inside the file. We also investigate whether or not the software we tested support HEIF and present the requirement of forensic tools to analyze HEIF.


Statistics
Show / Hide Statistics

Statistics (Cumulative Counts from September 1st, 2017)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article
[IEEE Style]
Y. Kwon, S. Bang, J. Han, S. Lee, "Forensic Analysis of HEIF Files on Android and Apple Devices," KIPS Transactions on Software and Data Engineering, vol. 10, no. 10, pp. 421-428, 2021. DOI: https://doi.org/10.3745/KTSDE.2021.10.10.421.

[ACM Style]
Youngjin Kwon, Sumin Bang, Jaehyeok Han, and Sangjin Lee. 2021. Forensic Analysis of HEIF Files on Android and Apple Devices. KIPS Transactions on Software and Data Engineering, 10, 10, (2021), 421-428. DOI: https://doi.org/10.3745/KTSDE.2021.10.10.421.