Performing malware analysis on android devices in terms of forensics

With the advancement of technology, today's cybercrimes can be performed by attackers using attack vectors on the user's mobile device. Android devices, one of the mobile device types, can be easily exploited due to weaknesses in the Android operating system and vulnerabilities in the application store. For forensic investigations, it is important to examine malicious software on Android devices with large data in terms of forensic information. Performing forensic copying, examination and analysis processes of Android devices with appropriate forensic tools contributes to the disclosure of investigations. For this reason, experts should have sufficient knowledge, equipment and experience about forensic tools that examine Android devices. Due to the constant updating of Android devices and the addition of new features, it is necessary to use the current versions of forensic tools that examine Android devices. In the thesis study, technical and theoretical information was given by performing penetration test scenarios from the perspective of the attacker, and the analysis of malware on the Android device was carried out in terms of forensic computing. At the point of performing malware analysis on Android device in terms of forensics, it is recommended to examine at least two mobile forensic software with logical physical image method. It is concluded that static and dynamic analysis of malicious applications should be performed by choosing the manual examination method at the point where the findings of malicious software are detected.