The Study And Application Of Data Recovery Method Based On The Android Mobile Phone

With the development, popularization and application of mobile communication technology, mobile crime is showing a new trend, mobile forensics is an effective mean to combat such crime. Most traditional methods extract information that stored in the phone with direct call phone API, these methods are simple and easy to operate, but you can not recover the deleted data. And for existing methods, it can restore phone data that misused or intentional deleted, but each has its advantages and disadvantages. Such as Chip removal method, the recovery speed is very high but difficult to achieve for requires high technology; Violence Estimation Method can recover deleted data more effective, but only for the entire memory cell, data that partly overwritten can not be recovered. Since2011, domestic mobile phone market with the highest share of Android phones. Therefore, the thesis focuses on the study and application of data recovery method based on the Android mobile phone, which combines with problems encountered during the internship. The main contents are as follows:In order to improve the recovery speed of deleted data, a method that estimates the Type field for each table pre-fetching data based on the Android is proposed thorough analysis logic and physical structure of SQLite database file and the addressing mode of data. Firstly, the method detects the size of each Type region where the deleted data tables, recover the deleted data with extraction recovery; then combine with "the try best efforts to recover method", to explore the recovery possibility of partially covered delete data, and recover it; finally, carry the experiment on the Android phone simulator. Experiments show that:this method can successfully recover deleted data, and compared with the Violence Estimation Method, without affecting the accuracy of extracting information of the premise, improve the recovery speed of deleted data.To ensure the authenticity of the extracted data, and improve the admissibility that takes extracted data as evidence, a fine-grained data integrity testing method is proposed. The method do data integrity checking on a fine-grained level by analysis the structure of phone memory, divide the granularity of data objects based on the evidence required characteristics of the actual case. The experimental results showed that:the introduction of granularity refinement data integrity testing, makes the mirroring process of the data extraction is more reliable. Realize the data integrity during the process of the extraction and analysis of evidence, while improve the evidence ability of electronic data that used as evidence in court.