Revisiting Android Forensics: An MCP-Based Contextual Review of Modern Mobile Investigations

Abstract

The strengthening of platforms, implementation of end-to-end encryption, scalability issues, and the temporary nature of modern mobile execution environments are becoming increasingly challenging in Android forensics. Modern forensic tools are mainly artifact-oriented, depending on file-system acquisition and comprehensive application analysis. Although these methods were effective in earlier Android ecosystems, they struggle to capture execution context across operating system services, runtime environments, software-enforced security services, cloud infrastructures, and user interactions. This paper reviews Android digital forensics within the Model Context Protocol (MCP) framework. Rather than proposing a new forensic framework, it redefines MCP as a perspective for organizing heterogeneous forensic evidence across multiple system dimensions, including temporal, execution, security, interaction, and external interaction contexts. Through a literature review, the paper highlights key weaknesses in existing forensic practices, particularly their limitations in addressing runtime-based threats, discontinuous evidence, and cross-layer dependencies. The relevance of MCP is further demonstrated through contemporary Android malware examples, such as file-less malware and privacy-invasive software, including spyware and stalkerware, supported by a case scenario. Finally, the paper identifies key research challenges and proposes future directions for achieving context-aware, memory-sensitive, and privacy-conscious Android forensics.