Research And Implementation Of YAFFS2 Data Recovery And Time Series Analysis Based On Android

Nowadays,with the development of mobile technology,mobile device is convenient to people live but also brings some security problems at the same time.Some criminals begin to use mobile device to communicate and deliver messages,so it is important to obtain information from mobile device.Mobile device Forensics is a process of obtaining,analysis and forensics from mobile device so that it can get digital evidence.But in the process of mobile device forensics,the data from device can be deleted or modified which take some difficulties in obtaining effective evidence and time series of evidence.Thus,it is necessary to research data recovery and time series from mobile device.And Android has two advantages.One is that Android has large market share which lots of people use Android mobile and another is that Android is an open source embedded system.So Android is choose to the target system in mobile device forensics research.And YAFFS2 file system is now widely used in Android system.So in mobile device forensics,YAFFS2 file system of Android as the research object is used to research data recovery technology and timestamp analysis method.In this paper,the first conclude the current research status at home and abroad of data recovery technology and time series analysis and analyze the current Android forensic technology in mobile forensics.This paper also analysis the different types of file system in Android system,especially YAFFS2 file system.Then based on the characteristics of YAFFS2 file system,this paper propose an algorithm to recover multiple versions of files based on Hash linked list and an algorithm to build time series based on timestamps.At the same time,the problem of missing data in file system is analyzed and this paper propose an idea to recover the missing effective object header chunk and data chunk.And this paper design an algorithm to recover missing data which based on the previous algorithm.After that,this paper use two type ways to evaluate the effectiveness of algorithm which use Hash linked list and timestamp to recover multiple versions of files and algorithm which add the process of dealing with the missing data.The experiment results also compare with the recovery results from yaffs2 img software.At last,using the algorithm implement the system program which can recover Android image files and analyze the information from applications in Android image files.As well as,this paper conclude the opportunities and challenges in the following research on data recovery technology and time series analysis method in mobile device forensics.