CN103064764A - Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone - Google Patents

Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone Download PDF

Info

Publication number
CN103064764A
CN103064764A CN2012105859402A CN201210585940A CN103064764A CN 103064764 A CN103064764 A CN 103064764A CN 2012105859402 A CN2012105859402 A CN 2012105859402A CN 201210585940 A CN201210585940 A CN 201210585940A CN 103064764 A CN103064764 A CN 103064764A
Authority
CN
China
Prior art keywords
mobile phone
data
record
android
root
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN2012105859402A
Other languages
Chinese (zh)
Inventor
李建新
李毅
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Rock Software (shanghai) Co Ltd
Original Assignee
Rock Software (shanghai) Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Rock Software (shanghai) Co Ltd filed Critical Rock Software (shanghai) Co Ltd
Priority to CN2012105859402A priority Critical patent/CN103064764A/en
Publication of CN103064764A publication Critical patent/CN103064764A/en
Pending legal-status Critical Current

Links

Images

Abstract

The invention discloses an evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone. The method includes: firstly extracting directly viewable information of a user data file in the mobile phone, obtaining storage characteristics of a database table structure according to the directly viewable information, and further separating an unused space in a database; trying to match characteristics of a normal record in the unused space, verifying matched data, obtaining a deleted record, partitioning subsequent data according to field length definition of the record, restoring content of main fields, contrasting restored data to the normal record, and adding in a record list through logical judgment; and matching the unused space continuously until all unused spaces are processed. The vidence obtaining method capable of rapidly recovering messages deleted by the Android mobile phone has the advantages of being rapid to recover, convenient to use and strong in reliability.

Description

A kind of evidence collecting method of fast quick-recovery Android mobile phone deletion information
Technical field
The present invention relates to mobile device information processing and deletion information and recover the field, specifically, specially refer to a kind of evidence collecting method of fast quick-recovery Android mobile phone deletion information.
Background technology
The methods of Mobile Phone Forensics are constantly being upgraded and are being improved at present, just the essential information in the mobile phone (such as the contact person, message registration and short message etc.) are simply extracted and are fixed at first.Afterwards along with the appearance of smart mobile phone, Mobile Phone Forensics has comprised also that application programs data (such as immediate communication tool, social networks instrument, location navigation instrument etc.) are extracted, fixing and association analysis etc.
The judicial personnel not only needs to extract the information of current existence on the mobile phone, the information special concern of also suspect having been deleted in investigation or evidence obtaining process.It mainly is following two kinds that the method for in the prior art Android mobile phone being deleted recovery has:
1) first method is the image file by the storage medium of making mobile phone.
If use simple DD order or other mirror image softwares, owing to be subjected to the structural limitations of the file system of mobile phone accumulation layer use, then can not acquire the information of complete file system, the image file that obtains can't be recombinated and is reduced into original file system.Go back in the situation of original file system can not recombinating, the positioning difficulty of concrete deletion information is increased, the identification of deletion information and the difficulty of checking are increased, the difficulty that deletion information and not deletion information are distinguished increases.
Although if use complicated external tool can obtain complete image file, if but image file is imperfect or larger, add the complexity effect of mobile phone storage data, the information that often recovers is more in disorder, or mixed a lot of fully irrelevant information inside, the effect of recovery is general or very poor.
2) second method is the information storage file to be positioned the general mode of rear use process.
Personal information in the general intelligence mobile phone is stored in the database file, usage data storehouse scan tool can view list structure and the field information of storage, but these information are optimized for storage, so when directly checking, the association between the field etc. needs evidence obtaining personnel oneself conjecture and checking.And the field information that the based on database storage organization recovers, need equally the evidence obtaining personnel these information associations, database professional knowledge to the evidence obtaining personnel is had relatively high expectations, and more or list structure is than under the complicated situation at database table, and accuracy and reliability can non-constants.
In sum, for the defective of prior art, need especially a kind of evidence collecting method of fast quick-recovery Android mobile phone deletion information, to solve above-mentioned deficiency.
Summary of the invention
The object of the present invention is to provide a kind of evidence collecting method of fast quick-recovery Android mobile phone deletion information,
Overcome the deficiency in the conventional art, thereby realized purpose of the present invention.
Technical matters solved by the invention can realize by the following technical solutions:
A kind of evidence collecting method of fast quick-recovery Android mobile phone deletion information, described method comprises the steps:
1) at first uses the pull order that provides among the debugging developing instrument Android Debug Bridge that provides among the Android SDK to extract subscriber data file in the mobile phone, and it is further analyzed, obtain and directly to check information in the subscriber data file;
2) read the data content that directly to check in the information by API, then come the concrete meaning of each field in the specified data content by contrast verification, obtain the visual data on the mobile phone after reconfiguring, also obtain the storage feature of database table structure simultaneously;
3) the storage character separation by database table structure goes out the not usage space in the database;
4) extract the feature of normal recordings by the storage organization of analyzing normal recordings in the Android mobile phone, then attempting this feature of coupling in the usage space by regular expression, and the data that match are verified; If its structure and normal recordings are consistent, think that then this is a record of having deleted, then in conjunction with the definition of the field length of this record, data are thereafter cut apart, to reduce the content of its each main field;
5) data that restore and the normal recordings of resolving by API are compared, if key message is identical, think that then this is a redundant data that has existed or had identical record to be resumed out in logic, do not add in the record tabulation; If key message is not identical, then add in the record tabulation;
6) continue to mate not in the usage space, until all not usage spaces all are disposed.
In one embodiment of the invention, described step 1) further comprises a kind of method of the root of obtaining authority, and the method is directly to promote outside root authority by adb root; If adb root prompting can't rise to the root authority, then rise to root user's authority by the script of an interim root.
In one embodiment of the invention, in the described step 5), when adding to the data that restore in the record tabulation with this data markers for deleting, show that this is a record that is resumed out.
In one embodiment of the invention, described subscriber data file is the SQLite3 database format, can read normally wherein data content by API.
In one embodiment of the invention, described debugging developing instrument Android Debug Bridge connects mobile phone by the application program debugging interface.
Beneficial effect of the present invention is as follows:
1) fast quick-recovery: the method is owing to prior list structure and storage organization to customer data base is studied and extracted feature, so speed is very fast in the information of undeleting.
2) easy to use: deletion recovers automatically to carry out after resolving normal recordings, need not the user and carries out any manual operation and analysis.
3) reliability is strong: to by scanning for concrete feature, specific aim is very strong, so the data of general recent deletion can both recover.
Description of drawings
Fig. 1 is the schematic flow sheet of the evidence collecting method of fast quick-recovery Android mobile phone deletion information of the present invention.
Embodiment
For technological means, creation characteristic that the present invention is realized, reach purpose and effect is easy to understand, below in conjunction with embodiment, further set forth the present invention.
As shown in Figure 1, the evidence collecting method of a kind of fast quick-recovery Android mobile phone deletion information of the present invention, its job step is as follows:
1) whether opened USB debugs (application program debugging interface) at first to need to determine target mobile phones, owing to most of third party's cell phone managing software all needs to use this function, so most of mobile phone is all opened.If do not open then need to open in the setting-〉 application program.
2) direct extraction document.Subscriber data file (such as address list file/data/data/com.android.providers.contacts/databases/conta cts.db) in the pull order trial extraction mobile phone that provides among the debugging developing instrument Android Debug Bridge (adb) that provides among the Android SDK is provided, because subscriber data file is private information, if prompting access denied, or the error message of Insufficient privilege and so on, then need the root authority to access.Attempt promoting outside root authority by adb root, continue to attempt extracting subscriber data file by top method.
3) promote the Root authority temporarily.If adb root prompting can't rise to the root authority, then can rise to by the script (by the mode of system vulnerability) of an interim root root user's authority, in the situation that obtains outside root authority, usually can both normal extraction arrive file.
4) extract user data.Extract after the needed subscriber data file, at first need to extract the already present data of user (data that can view at mobile phone), general this document is the SQLite3 database format, just can read normally wherein data content by its API that provides.Owing to there is not the original design document, need to determine by contrast verification the concrete meaning of each field, just can reduce visual data on the mobile phone after reconfiguring, the while also obtains the storage feature of database table structure.
5) separate not usage space.Because the SQLite database is file based database application, the operation of its deletion data is that mark should not re-use in the zone, so the data major part after the deletion is also all preserved hereof, no longer as seen, also have access to binary form in the time of just by data base querying.Can isolate all untapped spaces by the storage feature of data database table structure.
6) data that undelete.Extract the feature of record by the storage organization of analyzing normal recordings, then do not attempting this feature of coupling in the usage space by the mode of canonical, the data that match are verified, be consistent such as fruit structure and normal record, think that then this is a record of having deleted, then in conjunction with the field length definition of record, data are thereafter cut apart, to reduce the content of its each main field.
7) filter repeating data.The data that recover and the normal recordings of resolving by API are compared, if key message (such as the time, content, number etc.) is identical, thought that just this is a redundant data (existed in logic or had identical record to be resumed out).Then add in the record tabulation if not redundant data, be labeled as simultaneously and delete, show that this is a record that is resumed out.
8) continue to mate content in the usage space not, until all not usage spaces all are disposed.
More than show and described ultimate principle of the present invention and principal character and advantage of the present invention.The technician of the industry should understand; the present invention is not restricted to the described embodiments; that describes in above-described embodiment and the instructions just illustrates principle of the present invention; without departing from the spirit and scope of the present invention; the present invention also has various changes and modifications, and these changes and improvements all fall in the claimed scope of the invention.The claimed scope of the present invention is defined by appending claims and equivalent thereof.

Claims (5)

1. the evidence collecting method of a fast quick-recovery Android mobile phone deletion information is characterized in that described method comprises the steps:
1) at first uses the pull order that provides among the debugging developing instrument Android Debug Bridge that provides among the Android SDK to extract subscriber data file in the mobile phone, and it is further analyzed, obtain and directly to check information in the subscriber data file;
2) read the data content that directly to check in the information by API, then come the concrete meaning of each field in the specified data content by contrast verification, obtain the visual data on the mobile phone after reconfiguring, also obtain the storage feature of database table structure simultaneously;
3) the storage character separation by database table structure goes out the not usage space in the database;
4) extract the feature of normal recordings by the storage organization of analyzing normal recordings in the Android mobile phone, then attempting this feature of coupling in the usage space by regular expression, and the data that match are verified; If its structure and normal recordings are consistent, think that then this is a record of having deleted, then in conjunction with the definition of the field length of this record, data are thereafter cut apart, to reduce the content of its each main field;
5) data that restore and the normal recordings of resolving by API are compared, if key message is identical, think that then this is a redundant data that has existed or had identical record to be resumed out in logic, do not add in the record tabulation; If key message is not identical, then add in the record tabulation;
6) continue to mate not in the usage space, until all not usage spaces all are disposed.
2. the evidence collecting method of a kind of fast quick-recovery Android mobile phone deletion information according to claim 1 is characterized in that described step 1) further comprises a kind of method of the root of obtaining authority, and the method is directly to promote outside root authority by adb root; If adb root prompting can't rise to the root authority, then rise to root user's authority by the script of an interim root.
3. a kind of fast quick-recovery Android mobile phone according to claim 1 is deleted the evidence collecting method of information, it is characterized in that, in the described step 5), when adding to the data that restore in the record tabulation with this data markers for deleting, show that this is a record that is resumed out.
4. the evidence collecting method of a kind of fast quick-recovery Android mobile phone deletion information according to claim 1 is characterized in that described subscriber data file is the SQLite3 database format, can read normally wherein data content by API.
5. the evidence collecting method of a kind of fast quick-recovery Android mobile phone deletion information according to claim 1 is characterized in that described debugging developing instrument Android Debug Bridge connects mobile phone by the application program debugging interface.
CN2012105859402A 2012-12-28 2012-12-28 Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone Pending CN103064764A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2012105859402A CN103064764A (en) 2012-12-28 2012-12-28 Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2012105859402A CN103064764A (en) 2012-12-28 2012-12-28 Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone

Publications (1)

Publication Number Publication Date
CN103064764A true CN103064764A (en) 2013-04-24

Family

ID=48107397

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2012105859402A Pending CN103064764A (en) 2012-12-28 2012-12-28 Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone

Country Status (1)

Country Link
CN (1) CN103064764A (en)

Cited By (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103324482A (en) * 2013-06-27 2013-09-25 苏州创智宏云信息科技有限公司 Android one-key root permission software
CN103561176A (en) * 2013-11-07 2014-02-05 腾讯科技(深圳)有限公司 Method and device for acquiring call records of terminal device and terminal device
CN103747028A (en) * 2013-11-27 2014-04-23 上海斐讯数据通信技术有限公司 Method for granting user temporary root authority
CN103778259A (en) * 2014-03-03 2014-05-07 公安部第三研究所 Method for realizing data recovery of smart phone on basis of Sqlite3
CN103793298A (en) * 2014-03-03 2014-05-14 公安部第三研究所 Method for reading Android mobile phone information
CN103942054A (en) * 2014-04-25 2014-07-23 北京邮电大学 Data evidence obtaining system based on Android
CN104035839A (en) * 2014-06-12 2014-09-10 上海交通大学 Method for implementation of recovery of Android system private data
CN104142830A (en) * 2014-08-11 2014-11-12 四川效率源信息安全技术有限责任公司 Method and device for extracting application data of smart phone by script plug-in technology
CN104156430A (en) * 2014-08-11 2014-11-19 四川效率源信息安全技术有限责任公司 Device and method for fast extracting Android mobile phone data
CN104182541A (en) * 2014-09-05 2014-12-03 四川效率源信息安全技术有限责任公司 Method for showing smart phone data information
CN104850470A (en) * 2015-05-12 2015-08-19 浪潮电子信息产业股份有限公司 Method for fast recovering mis-deleted data under linux system
CN104932838A (en) * 2015-06-09 2015-09-23 南京邮电大学 Digital forensic method and system based on Android memory dump technology
CN105022949A (en) * 2015-07-02 2015-11-04 盘石软件(上海)有限公司 Handheld device for evidence fixing of Android phones and fixing method
CN105353665A (en) * 2015-12-08 2016-02-24 武汉虹旭信息技术有限责任公司 Mobile phone deleted information recovery system based on Android system and method thereof
CN105912423A (en) * 2016-04-07 2016-08-31 上海互盾信息科技有限公司 Data recovery and forensic method
CN106547771A (en) * 2015-09-18 2017-03-29 四川效率源信息安全技术股份有限公司 The method that web page browsing record based on Android system recovers
CN106557387A (en) * 2015-09-30 2017-04-05 四川效率源信息安全技术股份有限公司 The method that news client browing record based on Android system recovers
CN106934052A (en) * 2017-03-16 2017-07-07 维沃移动通信有限公司 A kind of media text handling method and mobile terminal
CN107332974A (en) * 2017-05-23 2017-11-07 成都联宇云安科技有限公司 A kind of method for recovering Android mobile phone address list and note data in the case where being not backed up data
CN108021469A (en) * 2016-10-31 2018-05-11 中国电信股份有限公司 Data recovery method and device
CN110275867A (en) * 2019-05-24 2019-09-24 北京指掌易科技有限公司 A method of extracting parsing Android mobile phone file
CN111667217A (en) * 2020-06-09 2020-09-15 宏图智能物流股份有限公司 Warehouse network information storage method

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060069540A1 (en) * 2004-09-28 2006-03-30 Krutz Ronald L Methodology for assessing the maturity and capability of an organization's computer forensics processes
CN101582076A (en) * 2009-06-24 2009-11-18 浪潮电子信息产业股份有限公司 Data de-duplication method based on data base
CN102298634A (en) * 2011-09-09 2011-12-28 厦门市美亚柏科信息股份有限公司 Structural reorganization method for Sqlite deletion record
CN102750204A (en) * 2012-06-07 2012-10-24 深圳市万兴软件有限公司 Data recovery method and device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060069540A1 (en) * 2004-09-28 2006-03-30 Krutz Ronald L Methodology for assessing the maturity and capability of an organization's computer forensics processes
CN101582076A (en) * 2009-06-24 2009-11-18 浪潮电子信息产业股份有限公司 Data de-duplication method based on data base
CN102298634A (en) * 2011-09-09 2011-12-28 厦门市美亚柏科信息股份有限公司 Structural reorganization method for Sqlite deletion record
CN102750204A (en) * 2012-06-07 2012-10-24 深圳市万兴软件有限公司 Data recovery method and device

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
姚伟等: "Android智能手机的取证", 《中国司法鉴定》 *
王随刚等: "基于SQLite3的Android手机数据恢复技术的研究", 《警察技术》 *

Cited By (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103324482A (en) * 2013-06-27 2013-09-25 苏州创智宏云信息科技有限公司 Android one-key root permission software
CN103561176A (en) * 2013-11-07 2014-02-05 腾讯科技(深圳)有限公司 Method and device for acquiring call records of terminal device and terminal device
US9742901B2 (en) 2013-11-07 2017-08-22 Tencent Technology (Shenzhen) Company Limited Method, apparatus and terminal device for obtaining call log
CN103561176B (en) * 2013-11-07 2015-08-19 腾讯科技(深圳)有限公司 A kind of message registration acquisition methods of terminal equipment, device and terminal equipment
CN103747028A (en) * 2013-11-27 2014-04-23 上海斐讯数据通信技术有限公司 Method for granting user temporary root authority
CN103747028B (en) * 2013-11-27 2018-05-25 上海斐讯数据通信技术有限公司 A kind of method for authorizing user's temporary root authority
CN103778259A (en) * 2014-03-03 2014-05-07 公安部第三研究所 Method for realizing data recovery of smart phone on basis of Sqlite3
CN103793298A (en) * 2014-03-03 2014-05-14 公安部第三研究所 Method for reading Android mobile phone information
CN103942054A (en) * 2014-04-25 2014-07-23 北京邮电大学 Data evidence obtaining system based on Android
CN104035839B (en) * 2014-06-12 2017-07-18 上海交通大学 Android system private data recovers implementation method
CN104035839A (en) * 2014-06-12 2014-09-10 上海交通大学 Method for implementation of recovery of Android system private data
CN104142830A (en) * 2014-08-11 2014-11-12 四川效率源信息安全技术有限责任公司 Method and device for extracting application data of smart phone by script plug-in technology
CN104142830B (en) * 2014-08-11 2017-06-06 四川效率源信息安全技术股份有限公司 The method and apparatus that smart mobile phone application data is extracted by script plug-in part technology
CN104156430A (en) * 2014-08-11 2014-11-19 四川效率源信息安全技术有限责任公司 Device and method for fast extracting Android mobile phone data
CN104182541A (en) * 2014-09-05 2014-12-03 四川效率源信息安全技术有限责任公司 Method for showing smart phone data information
CN104850470A (en) * 2015-05-12 2015-08-19 浪潮电子信息产业股份有限公司 Method for fast recovering mis-deleted data under linux system
CN104932838A (en) * 2015-06-09 2015-09-23 南京邮电大学 Digital forensic method and system based on Android memory dump technology
CN105022949A (en) * 2015-07-02 2015-11-04 盘石软件(上海)有限公司 Handheld device for evidence fixing of Android phones and fixing method
CN106547771A (en) * 2015-09-18 2017-03-29 四川效率源信息安全技术股份有限公司 The method that web page browsing record based on Android system recovers
CN106557387A (en) * 2015-09-30 2017-04-05 四川效率源信息安全技术股份有限公司 The method that news client browing record based on Android system recovers
CN105353665A (en) * 2015-12-08 2016-02-24 武汉虹旭信息技术有限责任公司 Mobile phone deleted information recovery system based on Android system and method thereof
CN105912423A (en) * 2016-04-07 2016-08-31 上海互盾信息科技有限公司 Data recovery and forensic method
CN108021469B (en) * 2016-10-31 2020-10-27 中国电信股份有限公司 Data recovery method and device
CN108021469A (en) * 2016-10-31 2018-05-11 中国电信股份有限公司 Data recovery method and device
CN106934052A (en) * 2017-03-16 2017-07-07 维沃移动通信有限公司 A kind of media text handling method and mobile terminal
CN107332974A (en) * 2017-05-23 2017-11-07 成都联宇云安科技有限公司 A kind of method for recovering Android mobile phone address list and note data in the case where being not backed up data
CN110275867A (en) * 2019-05-24 2019-09-24 北京指掌易科技有限公司 A method of extracting parsing Android mobile phone file
CN111667217A (en) * 2020-06-09 2020-09-15 宏图智能物流股份有限公司 Warehouse network information storage method
CN111667217B (en) * 2020-06-09 2022-07-12 宏图智能物流股份有限公司 Warehouse network information storage method

Similar Documents

Publication Publication Date Title
CN103064764A (en) Evidence obtaining method capable of rapidly recovering messages deleted by Android mobile phone
Ayers et al. Guidelines on mobile device forensics (draft)
KR101767454B1 (en) Method and apparatus of fraud detection for analyzing behavior pattern
CN102937926B (en) Method and device for recovering deleted sqlite files on mobile terminal
CN112106049A (en) System and method for generating private data isolation and reporting
Bommisetty et al. Practical mobile forensics
CN106909811B (en) Method and device for processing user identification
CN103942054A (en) Data evidence obtaining system based on Android
Riadi et al. Evidence gathering and identification of line messenger on android device
CN105095330A (en) Method and system for identifying file format based on compressed package content
CN105792152A (en) Method and device for recognizing pseudo base station short message
Rao et al. Forensic analysis of android mobile devices
Alatawi et al. Mobile forensics: A review
Krishnan et al. Smartphone forensic challenges
CN109815702B (en) Software behavior safety detection method, device and equipment
CN103902906A (en) Mobile terminal malicious code detecting method and system based on application icon
KR101264792B1 (en) Personal information protection system
Pieterse et al. Smartphone data evaluation model: Identifying authentic smartphone data
CN109308229B (en) Method for recovering WeChat chat records
ALJAHDALI et al. Mobile device forensics.
CN114265759A (en) Tracing method and system after data information leakage and electronic equipment
JP5851311B2 (en) Application inspection device
CN106384284A (en) Method and system for improving credit checking efficiency through technology means
CN106372530A (en) Method for viewing privacy data and device
Chen et al. Forensic analysis of email on android volatile memory

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C02 Deemed withdrawal of patent application after publication (patent law 2001)
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20130424