计算机工程Issue(10)：275-280,6.DOI:10.3969/j.issn.1000-3428.2014.10.051
Android系统删除数据恢复方法研究
Research on Recovery Method of Deleted Data for Android System
方冬蓉 1张秋余 1董瑞洪 1文森1
作者信息
- 1. 兰州理工大学计算机与通信学院，兰州730050
- 折叠
摘要
Abstract
With the development and the wide application of mobile communication technology, mobile phone crimes become a new trend,and mobile phone forensics is an effective means to crack down on mobile phone crimes. In view of the problems that the traditional method calling API directly cannot restore the data of Android mobile phone and existing methods cannot restore the deleted data that section covered,through deep analysis of Android SQLite database file structure and the addressing mode of data record,the method that detects and estimates each Type field in the table is proposed. This method uses extraction recovery to process deleted data,combines“restore method with best effort” to discuss the recovery possibility of the deleted data that part covered,and obtains the deleted data. This method is carried out on the Android emulator. Experimental result shows that this method can restore deleted data successfully,and compared with traditional algorithm,it improves the recovery rate of deleted data with no affection of the information extraction accuracy.关键词
手机取证/Android系统/SQLite数据库/数据删除/逻辑提取/物理提取Key words
mobile phone forensics/Android system/SQLite database/data deletion/logical extraction/physical extraction分类
信息技术与安全科学引用本文复制引用
方冬蓉,张秋余,董瑞洪,文森..Android系统删除数据恢复方法研究[J].计算机工程,2014,(10):275-280,6.
