The Research Of Android Mobile Phone Forensics System In Detective The Cases

In recent years, with the rapid development of mobile Internet 4G business technology, mobile terminal equipment represented by Android smartphone has become the mainstream of the market, due to its powerful function which supports a variety of applications, so that it is an indispensable communication tool in people’s daily life, work and entertainment. At the same time, high-tech crimes such as criminals using Android smartphone to communicate are rising year by year. In order to grasp the trend of criminals accurately and crack down on the crime, communication recording, call recording, SMS, photos, video, chat, Internet records and other documents in Android smartphone, has become an urgent task in case detection. The existing forensic means are taking software forensics as the main method, but this method usually requires the Android smartphone can normally operate. But in the course of the first-line detection of cases, the mobile phone involved in the case will be destroyed (e.g. phone damaged, etc.) by the suspects, brings big difficulty to the mobile phone forensics. In order to make up for the technical defects of software forensics, this paper makes a deep research on the underlying operating mechanism, storage mechanism and encryption mechanism of the mobile phone, which is based on JTAG, ISP and chip level technology. Using physical method to read the underlying data of the mobile phone, forensic process has nothing to do with the model, system version of the mobile phone or whether it has password or USB debug mode is open or the phone is damaged. And it can be fully extracted all deleted, not deleted data, brings the case key technical support in the detection.The present forensics situation and development trend of Android smartphone are studied, and the research ideas, methods and system structure of the paper were described.The definition of the Android Smartphone forensics technology, principles, content and type of processes were stated;Smartphone forensics structure, framework design, function modules of Android, and the presence of difficulties in technic and its solutions were analyzed.Forensic technology such as whether Android smartphone can normally open, shut down, access to Root permissions, get common functions of data, SQLite database, using ISP, JTAG and other underlying technology to read the full image, password crack and other method, extract forensics track and methods by combining software and physical methods to get data were analyzed. Android smartphone forensic process by combining software and physical methods in case detection was applied and improved.