Digital evidence obtaining system and method based on data information mirror image restoration through mobile terminal

Abstract

The invention discloses a digital evidence obtaining system and method based on data information mirror image restoration through a mobile terminal. The system comprises a native layer, a system framework layer, an application cloning space and a local application space. The native layer is connected with the system framework layer, the application cloning space and the local application space areboth connected with the system framework layer, a mirror image mounting file is arranged in the native layer, and cloning service is arranged in the system framework layer. The method includes the steps of firstly, deriving a mirror image file; secondly, analyzing and mounting the mirror image file; thirdly, establishing simulation service; fourthly, establishing an application cloning space. Byestablishing a layer of virtual device for mapping a reality device, the method of encrypting during writing and decrypting during reading is adopted for data currently required to be processed, and the data analyzing efficiency is effectively improved.

Description

technical field [0001] The invention relates to a digital evidence collection system and method for restoring data information based on a mobile terminal image. Background technique [0002] With the rapid development of various mobile terminals, when providing various convenient services for people's daily life, it has also led to the emergence of illegal and criminal methods using mobile terminal equipment. In order to effectively combat such illegal and criminal acts, public security agencies There is a need for practical equipment that can conduct electronic forensics on mobile devices, mainly mobile terminals. In the traditional forensics equipment, there is a special equipment for physical evidence collection. The main implementation process of this equipment is as follows: Figure 6 Shown: [0003] Each process is described as follows: [0004] (1) Extracting the physical mirror image, which is a copy of the mobile terminal disk data, and then generating a mirror im...

AI Technical Summary

Problems solved by technology

[0010] Disadvantage 1: Nowadays, with the popularity of mobile terminals, their data capacity is also growing explosively, and mobile terminals on the market basically adopt the form of full-disk encryption. The traditional forensic solution is to decrypt the entire partition data into plaintext at one time and then further analysis, which for increasing data volume, forensic efficiency will become slower

[0012] Disadvantage 2: For the extracted and decrypted plaintext data, it needs to be reassembled according to different formats defined by different applications, and presented in a way that humans can understand

Among them, with the frequent change of mobile terminal applications, the types of applications required for analysis are becoming more and more diverse. The same application often has many different versions. Traditional forensics solutions need to continuously study new applications and application-defined data content, which consumes a lot of time. A lot of time, not once and for all

And if the application itself has encrypted the data, the data cannot be parsed normally, which also brings certain difficulties to mobile digital forensics

Images