Impact of Multiple CPU Cores to the Forensic Insights Acquisition from Mobile Devices using Electromagnetic Side-Channel Analysis

Modern processors tend to incorporate multiple CPU cores. These multiple CPU cores, running at the same or different clock frequencies enable the effective distribution of workload and efficiency in energy consumption. While Electromagnetic Side-Channel Analysis (EM-SCA) has been shown to be an effective and non-invasive method to acquire forensic insights from smartphones and Internet of Things (IoT) devices, the presence of multiple CPU cores has the potential to cause disruptions this process. This research focuses on analysing the impact of multi-core CPU emissions — specifically the iPhone 13 and iPhone 14 Pro — to the EM-SCA-based forensic insights acquisition procedure. To achieve this, we developed a novel multi-core EM-SCA model specifically for iPhone models by integrating electromagnetic (EM) radiation traces captured from different core clusters of a single device. The developed multi-core model is then subjected to three transfer learning processes: inductive learning, feature extraction, and fine-tuning. The model is tested using individual single-core datasets collected at specific system-clock frequencies of the device. The findings of both smartphones indicate that inductive transfer learning consistently yields poor results, ranging between 5% and 20%, regardless of the core cluster. Although feature extraction provides moderate accuracy for certain datasets — around 50% to 70% for the iPhone 13 and 20% to 92% for the iPhone 14 Pro — it is the fine-tuning process that proves to be the most effective. Fine-tuning supports a wide range of datasets across different system-clock frequencies, achieving classification accuracy as high as 99%. This highlights fine-tuning as the most reliable transfer learning technique for multi-core forensic investigations. We also tested for catastrophic forgetting to evaluate the robustness of the multi-core model when using single-core datasets from the same devices. The results demonstrate that the accuracy of the multi-core model remains unchanged, even after the transfer learning process across various datasets.