Research Of Mobile Phone Forensics Technology Based On Android Platform

In recent years,smartphone technology has developed rapidly.And mobile phone functions are more and more abundant.Services such as mobile Internet,chat,and electronic trading are widely used.Meanwhile,some lawbreakers continually use mobile phones to do high-tech crimes.And the criminal evidence left in the cell phone has become an important basis for criminal detection in public security,procuratorate and courts.In order to control crime timely and effectively,and maintain social stability,how to extract evidence left in the smart phone in the case of legal and reliable is an important research content of the smart phone forensics.Smart phone forensics process is divided into four stages,which are preservation of evidence,evidence gathering,evidence analysis,and report generating.Evidence gathering is a priority for the mobile phone forensics;Evidence analysis extracts valuable information from available evidence data for cases.However,the deleted data of the mobile phone is what the forensic most concerned about,and is the breakthrough point of the cases.Generating a report is the last stage of the forensic process,and this report will give some valuable information to forensic and that will provide guarantee for solving cases rapidly.This dissertation foucus on the study of the technologies of evidences gathering,the basic data of smart phone recovering and evidences visualization.The major works and innovations of this dissertation are as follows.(1)The physical access technology and the logical access technology of the mobile data are studied.Under the deep analysis on the data storage structure of Android smart phone,the automatical acquisition tool of mobile data is designed and implemented based on the Android debugging tool,which is the foundation of the data recovery,analysis and visualization.(2)The image data recovery technology based on the feature code is proposed base on the storage structure and removing mechanism of the SQLite3 database,and implemented a rapid and accurate recovery of the deleted data,such as basic information of mobile phone,address book,call records,and SMS content.(3)This dissertation constructed an information network model based on the formal definition of mobile information network.Use genetic algorithm to achieve mobile information network graphics optimal solution by using the amount of contacts between contactor and contactee as weight.The social network visualization model based on weight has been realized,and it presents specifically forensic image of social networks.These are conducive to identify potential evidence for forensic quickly,decrease the difficulty of forensics and speed up the investigation.(4)The Android forensics prototype system is designed and implemented.Use this system to obtain smart phone data,and to restore basic information of smart phone,then to visualize and export the data of communication applications.