Extract And Analysis The Records Of The Browsers Base On The Smatr Cellphone

The concept of Smart phone has had a long time, people can see its prototypein many science fiction movies. it can do something that people cannot do. In fact,phone is just a phone at that time, it only has some simple functions, just like callfunctions. Otherwise, people use laptop or PDAs to processed document and Email,etc. As technology advances, also that people more concern about performanceand multiple functions, manufacturers add the function to the cellphone whichbelongs to Pocket PC. But there are so many manufacturers, so there are manyplans, and each of them cannot compatible with others. Also there isn’t have a goodSmart phone ecosystem, until9January,2007, at Apple’s Worldwide DevelopersConference, Apple releases a concept named iPhone, and sale it in June After29inthe same year which means the truly Smart phone is coming to our live.Smart phone has upgraded very fast in several years, now cellphone is not onlya communication tool, but also an assemble tool which has entertainment,multimedia applications, scheduling, document processing and other kind of mobileterminal functions. In the process of development, not just Apple’s iOS has marketshare, Google’s Android, Microsoft’s Windows Phone, Blackberry OS10fromBlackberry and Mozilla’s Firefox OS, etc also have its market, although not so high.Just aim to the Smart phone Market share, Apple’s iOS and Google’s Android havethe highly percent market share. Whether of the platform, the advantage of Smartphone is application, many applications support the OS. But at the same time,various cases involving Smart phone have become an usual type, including phishing,various and Trojan which have aggressive behavior, etc. So in the forensic evidenceand the investigation process, analyze the data from cellphone is becomeparticularly important.Now Smart phone has become an integral part of life, people go outside use navigation software, go internet use browser, entertainment and listening music andmore. Along with the rapid development of hardware, resulting in the gradualreplacement of laptop. But with the Smart phone’s platform gradually unified, Trojanand viruses in Smart phone have appeared. Needless to say, because of the GPL,Android is an open-source OS, which means anyone who reads the source can findsome bugs. So it become the best way to spread the Trojan and Viruses. We knowthe iOS has a sandbox which make it impossible to hack the system for user data innon-jailbreak, until a virus name WireLurker, when user infect this virus, it can breakthe sandbox to find user data and upload it in non-jailbreak.These are just a necessity forensics if the user been attacked, but if the user isa terrorist, do something illegal with the cellphone, that is the means of the forensics.The ultimate goal of this paper is to generate an analysis report, which statedthe results of the analyzed data from browser. First, the program has two analyticalmethods which represent the mainstream of forensics, one is extract file fromcellphone use ADB or iTunes API, another is directly copy the image file with root,right now only Android can do it. After analyze the cellphone, the program will createa report file including the record we find in the cellphone, most data is analyzed fromthe SQLite database, also the binary file store the record like Opera browser, so weneed a huge data to decode the structure from binary file. Here are some problemsin this program:1. character encoding2. support the old versionBecause the program is running on the Windows, Unicode is its defaultcharacter encoding, but SQLite database’s default character encoding is UTF-8, sowe need to transform the encoding when we write code, prevent the unreachablecode in the report. The old version problem is coming from the database structurechange when the application upgrade itself, so we need to do some research aboutthe old version, to compatible with it, also make the forensics program more general.In this description, because some browsers encrypt data exist, this papar doesnot involve the processing such a browser like this.