Received July 4, 2020, accepted July 20, 2020, date of publication August 6, 2020, date of current version October 1, 2020. Digital Object Identifier 10.1109/ACCESS.2020.3014615 A Review of Mobile Forensic Investigation Process Models ARAFAT AL-DHAQM 1,2 , (Member, IEEE), SHUKOR ABD RAZAK 1 , (Member, IEEE), RICHARD ADEYEMI IKUESAN 3 , (Member, IEEE), VICTOR R. KEBANDE 4 , AND KAMRAN SIDDIQUE 5 , (Member, IEEE) 1 Faculty of Engineering, School of Computing, Universiti Teknologi Malaysia (UTM), Skudai 81310, Malaysia 2 Department of Computer Science, Aden Community College, Aden, Yemen 3 Science and Technology Division, Department of Cyber and Networking Security, School of Information Technology, Community College of Qatar, Doha, Qatar 4 Computer Science and Media Technology Department, Malmö Universitet, 1, 211 18 Malmö, Sweden 5 School of Electrical and Computer Engineering, Information and Communication Technology Department, Xiamen University Malaysia, Kuala Lumpur 43900, Malaysia Corresponding authors: Arafat Al-Dhaqm (mrarafat@utm.my) and Richard Adeyemi Ikuesan (richard.ikuesan@ccq.edu.qa) This work was supported in part by the Research Management Center, Universiti Technologi Malaysia, through the Modeling Information Security Policy Field under Grant R.J130000.7113.04E96, and in part by the Open Access Funding provided by the Qatar National Library. ABSTRACT Mobile Forensics (MF) field uses prescribed scientific approaches with a focus on recovering Potential Digital Evidence (PDE) from mobile devices leveraging forensic techniques. Consequently, increased proliferation, mobile-based services, and the need for new requirements have led to the develop- ment of the MF field, which has in the recent past become an area of importance. In this article, the authors take a step to conduct a review on Mobile Forensics Investigation Process Models (MFIPMs) as a step towards uncovering the MF transitions as well as identifying open and future challenges. Based on the study conducted in this article, a review of the literature revealed that there are a few MFIPMs that are designed for solving certain mobile scenarios, with a variety of concepts, investigation processes, activities, and tasks. A total of 100 MFIPMs were reviewed, to present an inclusive and up-to-date background of MFIPMs. Also, this study proposes a Harmonized Mobile Forensic Investigation Process Model (HMFIPM) for the MF field to unify and structure whole redundant investigation processes of the MF field. The paper also goes the extra mile to discuss the state of the art of mobile forensic tools, open and future challenges from a generic standpoint. The results of this study find direct relevance to forensic practitioners and researchers who could leverage the comprehensiveness of the developed processes for investigation. INDEX TERMS Mobile forensics, investigation process model, digital forensics. I. INTRODUCTION Mobile Forensics (MF) as a branch of science is concerned with the recovery of digital evidence from mobile devices using prescribed and appropriate scientific forensic condi- tions [1]. Furthermore, this branch has become essential, owing to the increased demand for mobile-based services, increased users, and the sporadic changes that have been wit- nessed in mobile technologies like ubiquity, pervasiveness, and the fast-growing Internet of Things (IoT) technology that demands device connectivity. As a result, there is a growth in the popularity of mobile computing and the transactions tend to be scaling in an upward trajectory. The associate editor coordinating the review of this manuscript and approving it for publication was Longxiang Gao . Current research trends are mainly focused on explor- ing the MF professionals’ perception regarding the lack of digital investigation processes that can be used to prepare forensic reports applicable to court cases. Digital forensics is gradually becoming a complex discipline, especially with the proliferation of mobile devices in society. This is fur- ther complicated with the trend towards a digital intercon- nected society and industry 4.0 era. With this digitalisation comes the enormity and complexity of digital crimes, a phe- nomenon that the community of digital forensic professionals (researchers, practitioners, and standardisation organisations) is required to address. However, the complexity of investigat- ing mobile devices is considerably different from investigat- ing the other types of digital devices; as a result, the present study selected 24 MFIPMs proposed in the literature to offer VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ 173359