Research And Design Of Mobile Phone Information Forensics System

The world nowadays is a booming information age, mobile phone update veryquickly, at the same time,mobile phone crime cases is also increasing, mobile phonehas become a new means of crime, which hash a serious impact on social order andpublic life. Because we lack awareness of information security, and currently we donot have the corresponding technical requirements to collect criminal evidence,whichwill cause the mobile phone crime cases cannot be solved in time, and the criminalswill not be charged.Mobile phone information forensic means extract,protect, analyze and sort outvaluable clues or evidence which can be accepted by court from involved useridentity, communication content, activity location,address book and log informationwithin the internal memory and memory card,which can assist the judicial authoritiescrack down the case just like fingerprint.At home and abroad, mobile phone information forensics is in its initial stage,the existing forensic tools most only support basic information extraction, datarecovery, MD5check of the whole, and not for fine-grained integrity check, whichhas weakened the strength of the evidence.Based on the research of electronicevidence, this article introduces the principle of mobile phone forensics, and takeAndroid mobile phone for example, studies the technology and method of mobilephone forensics, then focused on the recovery algorithm based on Sqlite3andfine-grained data integrity checking method for Android mobile phone. After thetheory analysis, in the end,this paper partly realized the mobile phone forensicssystem on the Visual Studio2008platform.In summary, the research work of this paper are:(1) This article introduces the basic principles and common methods of mobilephone forensics. On the basis of these studies, this article takes android mobile phonefor example, studies the method of obtaining temporary root permissions and theprinciple of information forensics. (2) In view of the problem that traditional forensics methods directly call APIand can not recover the data from mobile phone which has been removed, Byanalyzing the physical storage structure of SQLite3database, and ascertaining thelocation of the deleted data, this article elaborates the process of recovering data fromAndroid mobile phone.(3) This article combine the fine-grained concept and integrity indicator codebased on error correction coding thought, proposes a fine-grained data integrity checkscheme, and applies it to the mobile phone information forensics system. In otherwords, the article subdivides the mobile phone memory data according to thefine-grained concept, and uses the cross validation mechanism in error correctingcode, carries out the idea of supervising more data block with less hash value,avoiding the hard consumption caused by a large number of hash data, but alsoguaranteeing the strength of hash check. Finally,this article imports three encodingschemes,and compared these three schemes in performance indexes such ascompression ratio, the ability of pointing out the mistake.We can choose thecorresponding integrity indication code according to the actual situation.