The Research On Technologies Of SQLite Data Recoverying On Android Phones

Smart-phone has been an indispensable tool for people in daily life.In all kinds of smart phones,Android mobile possesses a significant amount of users,and forensics technology of Android has been a spot of digital forensics.Data recovery technology is a focus of attention in all forensics technologies.Traditional forensics perform unsatisfactory and recall rate is small as the brand of smart phones and Apps are various,so researching on Android data recovery plays an important role.Android mobile phones mostly store records by using SQLite,and our paper researches the recovery method of SQLite data on Android phones.Firstly,we studyed the storage technology of Android smart-phone,which consist of “wear-leveling” mechanisms and “out of place write” principle used in NAND flash,Android storage partitions and storage mod,SQLite storage features and Write ahead log etc,and it is prepared for researching the recovery method of SQLite data on Android phones.Secondly,we proposed a data recovery method based on SQLite storage structure.We take advantage of the “out of place write” principle used in NAND flash,locate valid data pages from the image of phones,extract data area from the pages,restore the records according to the fields information,and achieve recovery of SQLite data.Experimental result shows that the accuracy rate of our method achieves 100% and recall rate achieves 87.6%,our method improves 80.8% compared with the method based on SQLite freeblocks,and it also applies to various file systems.Then,we proposed a data recovery method based on SQLite Write ahead log.This method is aimed at Android smart phones which take advantage of WAL,we can locate valid frame blocks according to random numbers from log and split joint the blocks,then we extract data pages from the blocks and rstore records according to the fields information.Experimental result shows that this method can solve the problem of log slice storage,and the accuracy rate of our method achieves 100%,recall rate achieves 100%,it improves 84% than the method based on SQLite freeblocks.Finally,we implemented a ASDRL system based on the two methods,the system unites mobile phone image extracting,fast recovery,deep recovery and user behaviors analysis.It proved that our recovery methods are applied.We got a deeply understand of Android data storage and SQLite by researched the recovery method of SQLite data on Android phones.We proposed the data recovery method based on SQLite storage structure and the data recovery method based on SQLite database pre write log,proved the feasibility and availability of our methods by experiments,made beneficial exploration for the forensics technology of Android phones.