| In recent years, the number of smart phone owners increased significantly. Smartphone, with its powerful features, becomes the main tool of communication quickly. Different from traditional mobile phones, smartphones have high-performance operating system(such as Android and i OS). Users can install a wide variety of applications on smart phones. With the increasing number of crimes related to mobile phones, social order and public life have been extremely affected. Data extraction and analysis of smart phones have important practical significance in assisting the public security departments to combat crime.This paper is based on the study of forensics research about YY software on android smartphones. This system is a practical project, which developed by the laboratory and the company. It realizes the forensics research automatically, which has greatly improved the efficiency of staff, disentangled the investigators from the onerous work and played an important influence on the theory and practice of forensic system.In this paper, the relevant principles and technical basis were introduced, including Android system architecture, the Root principle of Android system, security mechanism of Android, data storage mechanism of Android, the Chinese word segmentation technology, the application program interface of SQLite database and data analysis. The above theoretical knowledge is helpful to design the system.In order to obtain the application package of YY, smart phones were rooted. Then we analysed the files of the program package and located the files which store key data. Android uses the SQLite database to store data. This paper analysed the relationship between several database files and studied the structure of the tables. Depending on the data storage format, we studied the method of data extraction and designed the target database.Refer to the specific requirements and relevant standards provided by the ministry of public security, the system is developed and implemented. We extracted the information of a user account, buddy, buddy group, group, chat messages, and then parsed the data. Then we extracted the sensitive content in the chat messages and put them in the target database. Finally, the system adopts a visualization tool to demonstrate the results. Forensics investigators may locate data quickly and accurately.After the preliminary test and improvement, the system has basically met the needs of users and achieved the desired results. It has a certain practical significance for the department concerned to obtain evidence. |
