Research On The Principle Of Elimination And Recovery Of Micro - Letter Under IOS Platform And Technical Experiment

In the process at the promoting of national economy and the construction of social informationization, the judicial branch of government is beginning to pay more and more attention for the security of information,and for the fixation and forensics of data evidence too. Computer’s appearings let us out from the repetitive works. Advancing of the Telligent mobile terminal, have changed people’s mode of information processing from fixed to moving. Since twenty-first Century, the number of cases which locked suspect,or expanded clues,or fixed evidence was growing through the mobile phone. How to take a forensic for a mobile phone comprehensive and consistent with the judicial procedure, is becoming a difficult problem in the industry of data forensics. This paper was beginning from the research of iOS backup files, and then researched the files of WeChat. At last,we finded out the key database of WeChat.Through the research of Wechat’s key database, we proposed some methods to recovery deleted records of Wechat,and of course we verified these methods with experiments. By the contrast, this paper proposed some methods for data recovery. The integrity of the WeChat’s recovery data was better than mobile forensic software. It was proved that,some date may be still stored in the mobile phone,even they had been proceed by the mobile forensic software automatically. The research working in this paper, have taken a great practical significance to case investigators when they worked in mobile phone forensics.