Forensic Analysis Of Random MAC Addresses In Mobile Devices

At present,mobile devices adopt a MAC address randomization mechanism,which effectively protects the personal privacy of users and improves the security of mobile devices.However,the technical means of investigating and handling cases,such as the location and trajectory of criminal suspects,which were originally based on the analysis of mobile terminal MAC addresses,have failed.In this regard,this paper starts with the MAC address randomization mechanism adopted by Android and iOS devices,discusses the working principle of random MAC addresses of Android and iOS devices and its forensics methods,and combines the historical connection records of OpenWrt routers,and proposes a mobile network with random MAC addresses.Device Router Trajectory Analysis Method.The main research content and contributions of this paper are:1.Proposed random MAC address forensics method for Android and iOS devices.Starting from the operating systems of Android and iOS devices,deeply analyzing their file systems and storage structures,and based on an in-depth study of the working principle of random MAC addresses,a random MAC address forensics method for Android and iOS devices is proposed.2.Proposed a forensics method for key information of OpenWrt routers.Combing and analyzing the working principle of Wi-Fi network and OpenWrt router,especially,OpenWrt router forensics method based on random MAC address.In addition,taking the Xiaomi smart router as an example,the key information including basic system information,logs,connection records and random MAC addresses,and its evidence collection methods are analyzed in detail.3.Proposed a random MAC address-based mobile device router trajectory analysis method.Based on the above analysis results on random MAC addresses of mobile devices and OpenWrt routers,the method of identifying and analyzing the same device(MAC address randomization)in multiple OpenWrt routers is studied,and thus a mobile device in a random MAC address environment is proposed.The new method of reproducing the trajectory of the device router provides new ideas and technical support for the public security organs to investigate and handle cases.The experimental verification proves that the method is feasible and has certain promotion and application value.