【摘要】 不同于静态内存中敏感数据被加密存储,Android动态内存中一些敏感信息以明文的形式存在,如应用程序账户、密码、加密密钥以及一些缓存的应用数据等,这些数据具有极大的取证价值。而且随着智能手机动态内存容量的不断增大,越来越多的应用数据被缓存至动态内存中,针对Android智能手机动态内存的电子数据取证研究具有重要意义。文章分析对比了LiME及其改进方法、FROST、MEMGRAB及其改进方法、硬件提取方法等主要的Android智能手机动态内存提取技术,分析了进程分析、系统信息分析、密钥分析、账号密码和应用缓存数据分析等主流的Android智能手机动态内存分析技术。文章通过分析得出了这些方法存在的问题和不足并提出未来研究方向的建议,以帮助取证人员更好地开展Android智能手机的取证工作。更多还原

【Abstract】 Different from the sensitive data in static memory being encrypted and stored,some sensitive data in Android dynamic memory exists in the form of plaintext, such as application account, password, encryption key and some cached application data, which have great forensics value. In addition, with the increasing capacity of dynamic memory of smart phones, more and more application data are cached in the dynamic memory, the forensics research on the dynamic memory of Android smart phones is of great significance. This article analyzed and compared several Android smartphones dynamic memory extraction technologies, such as LiME, improved LiME, FROST, MEMGRAB, improved MEMGRAB and hardware extraction method, and several Android smartphone dynamic memory analysis technologies, such as process analysis, system information analysis, encryption key analysis, application account and password analysis. It is concluded that these methods have deficiencies in applicability, efficiency or operability. Through analyzing the weakness of these digital forensics technologies, this article gave some improvement advices and future research directions. The work of this article is able to benefit digital forensics practice of Android devices.更多还原