| High-tech crimes taking mobile phone as tools increase, for the evidence obtaining and investigating process, it is particularly important to analyze and fetch the electric data within mobile phone site. Public security departments need to fetch phone’s phone book, call records, text messages and user files electric information data, when possible they need to recovery the deleted phone book, call records, text to help related departments to investigate and collect evidence. In order to effectively solve the problem of phone forensics and to keep data’s integrity, availability and practicality, this paper proposes a forensic system aiming at Android system to store data.Paper introduces the design, development ideas and test methods of this forensics system, and it describes the design and implementation process in detail. In the technical design, data extraction uses C++, which can be packaged as DLL file, and makes background call through C#, Winform form. The system adopts Sql Server2012 database system to save the system’s forensics data.System mainly achieves four functions, namely data extraction, case management, data viewing, system analysis and reporting. Data Extraction achieves Android system’s API interface data extraction, deleted data recovery and extraction, Android exploits, password cracking and reduction, providing right and data acquisition; The case management realizes case data management, evidence management; The data viewing mainly achieves check extracted data, such as address book data view, text messages data view, e-mail information data view, GPS information data view, memo data view, call history data view, browser bookmarks View, QQ friends View, Skype View, micro-channel data view; The system analysis and reporting mainly realizes file browsing, searching system, exporting report, overall image.After the running of this system, we can effectively solve the problems that recover and fetch the deleted electronic data such as phone book, call records, and the system could help public security department to investigate. The system has high availability and could be used to public judiciary and could help to solve some problems, having a certain practical significance. |
