基于WinHex手机图片信息的恢复与取证  

Smartphone Image Recovery and Forensics Based on WinHex

作　　者：危蓉[1] 麦永浩[1] 

机构地区：[1]湖北警官学院,武汉430034

出　　处：《信息安全研究》2016年第4期328-332,共5页Journal of Information Security Research

基　　金：国家"八六三"高技术研究发展计划基金项目(2015AA017204);公安部应用创新计划基金项目(2013YYCXHBST030);湖北警官学院院级重点基金项目(2015ZD003)

摘　　要：智能手机已逐渐成为当前电子取证调查中重要的信息来源之一.针对Android智能手机的图片被删除或被损坏时信息获取困难的问题,提出了一种基于WinHex工具的文件恢复方法.在实验中,通过创建手机存储镜像,分析文件头尾部标识,成功提取了手机的图片文件.Smartphone has gradually become one of important sources of information in th e current electronic forensics investigation. Aiming at the difficult problem of information acquisition when the picture of the Android smartphone was deleted or damaged, a file recovery method based on WinHex tools is provided. In experiments, by creating a cell phone store image and the header and tail sign of file, the phone＇s image files were extracted.

关 键 词：智能手机 安卓系统 WinHex工具 图片 电子取证 

分 类 号：TP393.04[自动化与计算机技术—计算机应用技术]