A memory data forensics method based on Android platform automated test tool

Abstract

The invention discloses a memory data forensics method based on an Android platform automated test tool. The method uses the automatic test tool UIAutoMator provided by the Android system to simulatethe operation function of the mobile phone. When the user operates the mobile phone to enter a certain interface, the current page data is generated into an xml file through the automatic test tool UIAutoMator; and when the user operates the mobile phone to enter an interface, the xml file is generated through the automatic test tool UIAutoMator. the above-mentioned xml file is analyzed and data collection is completed; When the automatic test tool UIAutoMater cannot resolve the data in the specific interface, the screenshooting function of the automatic test tool UIAutoMater is called to process the screenshooting of the current specific interface, and then the screenshooting pictures captured are recognized and analyzed to complete the data collection. the method effectively solves the shortcomings of the traditional forensics technology and provides a digital forensics method in the intelligent mobile terminal Android system.

Description

technical field [0001] The invention discloses a memory data forensics method based on an Android platform automatic test tool, and relates to the technical field of digital forensics for intelligent mobile terminals. Background technique [0002] With the popularity of smart phones and the wide launch of various APPs running on them, everyone's daily life has been greatly enriched, but at the same time, various cases generated through smart phones have also increased, which has brought great impact on the mobile phone forensics industry. Come a tough challenge. According to the data released by the market research company Gartner in February 2018, the market share of Android has reached 86%, and that of iOS system is 14%. The two together account for 99.9% of the market. And along with the continuous update of Andorid and iOS system versions, the security of the mobile phone system is also constantly enhanced, especially the Android system, because of its open source, ther...

AI Technical Summary

Problems solved by technology

[0004] 1. Android 4.4 and later versions have enabled the selinux mechanism and other security mechanisms by default, making it very difficult to obtain su authority through rooting the mobile phone, thus affecting the development of forensic work

[0005] 2. The FDE (Full Disk Encryption) mode has been enabled by default since Android 6.0, resulting in the image download function not working through the chip manufacturer's burning tool

[0006] 3. Android 7.0 has been enabled by default and does not allow downgrading and installing applications, which makes the function of obtaining application data by downgrading the App unavailable. In addition, if the mobile phone has enabled multi-user mode, the application data under the avatar system cannot be passed through the traditional method. to collect

[0007] 4. For Android 7.0 and later versions, if the mobile phone manufacturer does not provide its own backup function, it will become very difficult to obtain the data of the mobile phone;

[0008] 5. For some APPs running on Andorid mobile phones, their application data is not saved locally, so even if local files can be obtained, their related application data cannot be obtained

Images