The Research Of Android Mobile Phone Forensics System

With the continuous improvement of the communication technology, smart phones are widely used. At the same time,the high-tech crime using mobile phones increases gradually. So analysis of mobile terminal data becomes more and more important during the Forensics and investigation. Ministry of Public Security urgently need to get the phonebook,SMS,call history, user files and other user information, even recover the deleted data mentioned above, in order to help their work to the greatest extent.This thesis firstly analyzes the current status and development trend of mobile forensics. For Android mobile using the SQLite database for data storage, the database structures of SMS,contacts and call records are analyzed in detail.On this basis, much research on data recovery is carried out, and the deleted data of SMS, contacts and call records is restored successfully to a certain extent. The thesis conducts analysis on some databases, which contains sensitive information from third-party software, such as QQ,skype,email and so on, and extracts the relevant information, storing these data in a local database. In addition, combining contacts and third-party software data, the paper takes the contacts as core to builds association relationship, and then classifies the "note" item in contacts by using support vector machine algorithm,finally uses Android simulator environment to simulate login of the software which the password can not be obtained, which give a further chance to access more proof.The paper finally implements the Android mobile forensics software by programming. The software has been improved gradually with repeated test, and it has practicability and important significance for judicial department and public security department.