谷歌浏览器隐私模式下的网址信息获取方法  

Acquisition Method of the Website Address in Google Chrome Incognito Mode

作　　者：徐楠楠 赵辽英[1] XU Nannan;ZHAO Liaoying(School of Compute,Hangzhou Dianzi University,HangzhouZhejiang 310018,China)

机构地区：[1]杭州电子科技大学计算机学院,浙江杭州310018

出　　处：《杭州电子科技大学学报（自然科学版）》2018年第4期47-51,81,共6页Journal of Hangzhou Dianzi University：Natural Sciences

摘　　要：针对谷歌浏览器取证过程中存在的隐私浏览模式的问题,提出一种Android手机端谷歌浏览器隐私浏览模式下的网址信息获取方法。首先,利用LIME工具从Android手机的易失性动态内存中获取完整的内存镜像数据,过滤处理后使用正则匹配技术来提取网址信息,并结合KMP匹配算法与多线程处理机制将提取的网址与普通浏览模式下的网址进行匹配,得到用户在隐私浏览模式下的网址信息。实验结果表明,运用该方法可以从Android手机的易失性动态内存中有效提取用户在chrome浏览器隐私浏览模式下的网址信息。With the frequent occurrence of mobile phone crime,mobile phone forensic has become an important part of the investigation of such cases,and the extraction of the URL information in incognito mode of Google chrome is crucial.This paper studies the acquisition method of the website address in Google chrome incognito mode.Firstly,the full memory image data are obtained from Android mobile phone＇s volatile dynamic memory using Lime tools,then using the regular matching technique to extract the URL information after data filtering.Finally,the website addresses in incognito mode are obtained after the extracted website address are matched with the website address in normal browsing mode using KMP matching algorithm and multi-threaded processing.The experimental results show that the proposed method can effectively acquire the website address in Google chrome incognito mode from Android volatile memory.

关 键 词：手机取证 CHROME浏览器 隐私模式 Android易失性内存 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]