摘要
目前针对手机的取证软件大部分是从逻辑层面提取数据而不是从存储介质中提取数据,本文提出了从底层对闪存进行取证的方法,并给出三种从底层拷贝闪存数据的方法。基于MTK不同芯片型号的NandFlash使用的文件系统进行研究,针对不同MTK芯片型号的手机展示了如何拷贝FLASH存储介质中的数据,将提取的闪存镜像数据重组并转换为普通取证工具所能识别的文件系统,并在此基础上提取手机上的电话本、短信、图片等重要数据[1]。
Current forensic tools for examination mobile phones mostly perform data extraction on a logical level and do not consider the type of storage media during data analysis. This paper suggests a low level approach for the forensic examination of flash memories and describes three low-level data acquisition methods for making full memory copies of flash memory devices. For different MediaTek mobile phones is shown how full memory copies of their flash memories can be made and which steps are needed to translate the extracted data into a format that can be understood by common forensic media analysis tools. And recovery mobile phones phonebook,sms,image etc.
出处
《信息网络安全》
2010年第11期34-36,共3页
Netinfo Security
