Digital forensic method and system based on Android memory dump technology

Abstract

The invention discloses a digital forensic method and system based on Android memory dump technology. The system comprises the following steps: determining that the Android equipment has been rooted, and starting a USB debugging function; dumping a physical memory of the Android equipment; statically searching the dumped Android memory to excavate sensitive data; dynamically analyzing the physical memory, listing information such as running processes, open ports and loading modules of the equipment, detecting whether rogue program is existent in the equipment; analyzing structure features stored in the memory through application program data, and extracting locally encrypted and stored application data; detecting different type data of the application program, namely: text, voice, pictures and the like, and attempting to recover deleted data in the memory; searching user information such as username, password and the like in the memory to detect whether the application program can safely protect user privacy; and generating a digital forensic summary report according to the memory analysis result. Through the adoption of the method and system disclosed by the invention, the effectiveness and completeness of the digital forensic at a mobile terminal are improved, and the extensive technical and market application value are realized.

Description

technical field [0001] The present invention relates to the technical field of forensics analysis, in particular to the technical field of Android platform forensics in digital forensics, and specifically refers to a digital forensics method and system based on Android memory dump technology. Background technique [0002] Android digital forensics refers to the process in which forensic personnel extract, transmit, save, analyze and submit electronic evidence existing in Android mobile terminals or other electronic devices in accordance with legal norms. When forensics personnel use digital forensics tools to forensics Android devices, they can reason and analyze the case based on the analysis results of the data in the device by the forensics tools, and finally get a forensics report generated by the forensics tools. Since the purpose of digital forensics is to collect and discover evidence from related electronic devices such as mobile electronic devices, two key technolog...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to overcome the digital forensics difficulties of traditional forensics technology in Android mobile terminals, mainly aiming at the problems of obtaining encrypted data of applications and recovering and deleting records, and providing a technical method for analyzing Android physical memory through memory dump , mine encrypted and deleted data for apps, and detect devices for malicious programs

Images