MTK手机Flash芯片文件系统恢复研究

目前针对手机的取证软件大部分是从逻辑层面提取数据而不是从存储介质中提取数据,本文提出了从底层对闪存进行取证的方法,并给出三种从底层拷贝闪存数据的方法。基于MTK不同芯片型号的NandFlash使用的文件系统进行研究,针对不同MTK芯片型号的手机展示了如何拷贝FLASH存储介质中的数据,将提取的闪存镜像数据重组并转换为普通取证工具所能识别的文件系统,并在此基础上提取手机上的电话本、短信、图片等重要数据[1]。     

智能手机数据的提取与恢复研究

随着移动通信技术的发展,智能手机逐渐成为人们工作生活中必备的通讯工具,与此同时手机犯罪也与日俱增,手机数据的提取与恢复是打击这类犯罪的有效手段,手机取证技术的研究迈向新的高度.主要介绍了手机数据存储分类、数据获取的方法以及数据的提取与恢复.     

基于Android平台的手机取证技术

随着网络信息技术的普及,利用手机进行犯罪的案件呈上升趋势。智能手机取证成为司法行政机关用于侦破此类案件的关键。手机取证的信息来源多为手机机身内存、SIM卡,部分信息可由相关部门授权从移动网络运营商处获取。获取手机自身证据信息的常用方式有root技术、USB调试模式、JTAG提取技术及Chipoff提取方法。取证人员可根据具体检材选择合适的证据提取方式。     

新型智能终端取证技术研究

随着移动互联网的广泛应用,智能手机、平板等新型智能终端设备在各种各样的违法犯罪活动中开始扮演越来越重要的角色,从涉案手机中提取的数据常常包含与违法犯罪行为相关的重要线索和证据。然而,移动智能终端设备不断提升的安全设计可能使得取证人员无法从设备中提取数据,给电子数据取证鉴定工作提出了新的挑战。本文详细分析当前主流的iOS、Android和Windows Phone等平台下的移动设备的安全机制,研究了主要的安全机制破解和取证技术及其在目前电子数据取证工作中的应用。最后,对未来面向新型移动智能终端电子数据取证技术研究发展方向进行了探讨。     

电子取证应用研究综述

近年来,电子数据取证对案件侦破起着重要的作用,由于电子数据具有易失性、易破坏性等特点,需要取证人员具备专业的电子取证技术和方法,才能最后分析出有用的证据,保证案件的真实性和客观性,详细分析三种取证技术和方法：基于Windows的电子取证、基于智能手机的电子取证,基于网络的电子取证,其中基于智能手机的电子取证包括Android手机和iPhone手机,并提出电子取证技术未来的发展方向.     

基于手机的取证调查模型研究

给出了手机取证的概念,并与计算机取证进行了比较,分析了手机取证和计算机取证的差异。结合手机取证的特点和难点,提出了基于手机的取证调查模型,分析了模型中各个阶段的具体活动。该模型对取证人员具有一定的指导意义。     

手机仿真取证系统浅析——Android系统仿真实战

随着各种手机的推广,手机应用程序的极大丰富,在实际取证工作中,我们经常会遇到对各种手机的应用程序取证,而现有对手机应用程序的分析技术刚刚起步,要实现对大部分应用程序使用痕迹的取证需要一段较长的时间。如何快速对手机应用程序进行取证成为取证工作的一个重要。因此本文提出了一个手机仿真取证系统的解决方案,并以Android系统为例进行介绍。     

面向手机取证的细粒度数据完整性检验方法

手机取证过程中的多种动态性因素都会导致前后两次内存镜像不一致,从而影响获取证据的真实性和可采性。分析了手机内存中的数据变化规律,引入细粒度完整性检验方法对手机内存镜像中的数据对象按照细粒度分别进行完整性检验。结合各种案例选取不同数据对象作为证据的需求,将手机内存镜像数据划分为不同粒度的数据对象。该方法可以有效地隔离不同数据对象,使得在内存镜像变化难以避免的情况下,验证了取证镜像过程的可靠性,证明目标数据对象的完整性,从而保证作为证据的数据对象能够被法庭接受。     

Android系统删除数据恢复方法研究

随着移动通信技术的发展和应用的推广,手机犯罪成为新的犯罪趋势,手机取证是打击该类犯罪的一个有效手段。直接调用API方法不能恢复Android手机数据,现有方法存在无法恢复删除数据部分被覆盖的问题。为此,通过分析Android系统SQLite数据库的文件结构和数据记录的寻址方式,提出一种Android系统删除数据恢复方法,即探测估算预提取数据所在表的每个Type字段,提取恢复删除数据,结合尽最大努力恢复方法,针对删除数据部分被覆盖的情况,讨论其恢复的可能性并进行获取。在Android手机模拟器上进行验证,结果表明,该方法能成功恢复删除数据,与传统方法相比,在不影响信息提取精确度的前提下,提高了删除数据的恢复率。     

手机规范取证研究

着立法滞后,规范等问题,取证的方法．在司法实践中,涉及到手机的案件越来越多,手机取证的重要性日益突出,但在取证中却存在移动通信技术检验机构不完善,缺少高素质的取证人员,技术落后,缺乏取证的意识和流程不阻碍了手机电子证据在司法实践中的应用。文章针对手机取证中存在的问题,探讨了规范手机为手机取证的规范化提供理论参考。     

Potential cyberterrorism via a multimedia smart phone based on a web 2.0 application via ubiquitous Wi-Fi access points and the corresponding digital forensics

Cyberterrorism has become a hotly debated research issue in the past decades because of the convergence of mobile computing powers and the fledging multimedia communication computing capabilities. Cyberterrorism is the exploitation of computer network tools to incur malfunction or shut down critical infrastructures with several keyboard punches, which is dramatically different from traditional terrorism. Due to the ubiquitous multimedia communication tools, they have radically transformed the ways concerning data transmission. Unfortunately, it also incurs unprecedented opportunities for committing cyber crimes that we were not able to foresee two decades ago. Undoubtedly, the mushrooming proliferation of mobile phones spectacularly triggers the information security leakage while most people heavily rely on mobile phones for daily communication. As cybercrime or cyberterrorism surges, digital forensics (DF) of mobile communication devices still enormously lags behind than computer forensics. Hence, in this research paper, we provide a hypothetical case review concerning the DF of a potential cyberterrorist attack that was triggered by a mobile multimedia smart phone utilizing a popular web 2.0 application program via ubiquitous Wi-Fi access points. The corresponding DF of the mobile device was conducted in a step-by-step manner as well as the crime scene reconstruction based on the digital evidence collected, analyzed, and preserved.     

Integrated Approach to Detect Cyberbullying Text: Mobile Device Forensics Data

Mobile devices and social networks provide communication opportunities among the young generation, which increases vulnerability and cybercrimes activities. A recent survey reports that cyberbullying and cyberstalking constitute a developing issue among youngsters. This paper focuses on cyberbullying detection in mobile phone text by retrieving with the help of an oxygen forensics toolkit. We describe the data collection using forensics technique and a corpus of suspicious activities like cyberbullying annotation from mobile phones and carry out a sequence of binary classification experiments to determine cyberbullying detection. We use forensics techniques, Machine Learning (ML), and Deep Learning (DL) algorithms to exploit suspicious patterns to help the forensics investigation where every evidence contributes to the case. Experiments on a real-time dataset reveal better results for the detection of cyberbullying content. The Random Forest in ML approach produces 87% of accuracy without SMOTE technique, whereas the value of F1Score produces a good result with SMOTE technique. The LSTM has 92% of validation accuracy in the DL algorithm compared with Dense and BiLSTM algorithms.     

Cost effective data wiping methods for mobile phone

Thanks to the supply of smartphones, mobile phones have come to store increasingly more personal information of users. To protect users’ information, the information stored in mobile phones should not only be managed safety but also be deleted not to allow restoration. In the filesystems that have been applied to existing mobile phones, even when users have deleted information, data are not completely wiped from the storage. Therefore, the data can be easily recovered by using forensics tools. Considering that mobile phones are always exposed to the risk of robberies and loss, this situation can be misused for personal information spill. The present paper points out problems in the methods of data deleting from smartphones, proposes an efficient data deleting method considering mobile device environments with limitations in battery and hardware performance such as smartphones, and analyzes the efficiency of the techniques in relation to the types of filesystems and data formats.     

Instagram Mobile Application Digital Forensics

In this research, we developed a plugin for our automated digital forensics framework to extract and preserve the evidence from the Android and the IOS-based mobile phone application, Instagram. This plugin extracts personal details from Instagram users, e.g., name, user name, mobile number, ID, direct text or audio, video, and picture messages exchanged between different Instagram users. While developing the plugin, we identified resources available in both Android and IOS-based devices holding key forensics artifacts. We highlighted the poor privacy scheme employed by Instagram. This work, has shown how the sensitive data posted in the Instagram mobile application can easily be reconstructed, and how the traces, as well as the URL links of visual messages, can be used to access the privacy of any Instagram user without any critical credential verification. We also employed the anti-forensics method on the Instagram Android’s application and were able to restore the application from the altered or corrupted database file, which any criminal mind can use to set up or trap someone else. The outcome of this research is a plugin for our digital forensics ready framework software which could be used by law enforcement and regulatory agencies to reconstruct the digital evidence available in the Instagram mobile application directories on both Android and IOS-based mobile phones.     

The action of looking at a mobile phone display as nonverbal behavior/communication: A theoretical perspective

This study investigates the now-common action of looking at a mobile phone display, thereby offering insight into the present communication situation in an era in which the use of high-performance mobile phones has become ubiquitous. In this study, the action of looking at a mobile phone display is considered nonverbal behavior/communication. This study applies a basic, general model to elucidate the present situation of face-to-face communication in light of the increasing prevalence of social interaction via mobile phone use. The results derived from the model include mobile phone users’ increasing social power and an accumulation of potential discontent in relation to different interpretations. This study concludes that in an era of high-performance mobile phones, the social context in face-to-face communication can be influenced by the act of looking at a mobile phone display.     

手机取证概述

手机犯罪现象作为高科技犯罪的一种,是近来刚刚涌现出的新问题,亟待研究相应的对策加以对付。本文主要介绍手机取证的电子证据来源以及相应取证分析的方法,最后提出手机取证应解决的问题。