面向Android取证的内存镜像数据恢复方法  

Memory image data recovery method for Android forensics

作　　者：张雪 狄芳[2] 苏铓[1] 俞研 Zhang Xue;Di Fang;Su Mang;Yu Yan(School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094,China;Department of Mathematical and Physical Sciences,Sanjiang University,Nanjing 210012,China)

机构地区：[1]南京理工大学计算机科学与工程学院,江苏南京210094 [2]三江学院数理部,江苏南京210012

出　　处：《南京理工大学学报》2022年第4期387-394,共8页Journal of Nanjing University of Science and Technology

基　　金：国家自然科学基金(62072239);南京理工大学自主科研专项计划(30921013111)。

摘　　要：安卓(Android)设备生成的用户数据存储在非易失性内存中,从取证的角度来看,非易失性内存中驻留的数据至关重要,可以从中获得犯罪活动的关键证据,因此研究从内存镜像中恢复有价值的证据数据极为重要。该文提出了一种面向Android取证的内存镜像数据恢复方法,通过对内存页结构的分析以及对未删除和已删除数据的获取,实现了数据表和记录的恢复,进而完成了数据库的重构,实现了Android设备内存镜像数据的恢复,并从恢复数据量、通用性、数据恢复能力、文件完整性和数据恢复效率等方面进行了试验分析。试验结果表明,该方法是通用且有效的。The user data generated by Android devices are stored in non-volatile memory.From the perspective of forensics,the data residing in non-volatile memory are vital and the key evidence of criminal activities can be obtained from them.Therefore,it is extremely important to study the recovery methods of valuable evidence data from memory images.This paper proposes a memory image data recovery method for Android forensics.By analyzing the structure of memory pages and obtaining undeleted and deleted data,the data tables and records are recovered,and then the database is reconstructed,and the memory image data of Android devices are recovered.The experimental analysis is carried out in the aspects of recovered data volume,universality,data recovery capability,file integrity and data recovery efficiency.The experimental results demonstrate that the method is universal and effective.

关 键 词：安卓取证 非易失内存 内存镜像 内存页 数据恢复 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]