文章基本信息

标题：A Reconstructing Android User Behavior Approach based on YAFFS2 and SQLite
本地全文：下载
作者：Xu, Ming ; Yao, Jun ; Ren, Yizhi 等
期刊名称：Journal of Computers
印刷版ISSN：1796-203X
出版年度：2014
卷号：9
期号：10
页码：2294-2302
DOI：10.4304/jcp.9.10.2294-2302
语种：English
出版社：Academy Publisher
摘要：Nowadays, a variety of Android user behavior information is automatically stored in SQLite to indicate when and what user behavior took places. In this paper, an approach to reconstruct Android user behavior from YAFFS2 based on SQLite is proposed. Based on the storage mechanism of YAFFS2 file system and the file structures of SQLite, all of the SQLite records can be recovered from the Android image, regardless of whether the SQLite file has been deleted or not in YAFFS2, and the user behaviors are parsed from those recovered SQLite records; then an Android user behavior timeline is constructed for visualizing based on the time stamp stored in it’s SQLite records. The evaluated experiment results show that the proposed method can reconstruct user behavior correctly, and can obtain more user behaviors than Encase to help investigators to complete digital forensic.
关键词：digital forensics;android;yaffs2;sqlite;user behavior