【作者】 陈阳；

【导师】 陈立全； 夏小忠；

【作者基本信息】 东南大学 ， 电子与通信工程（专业学位）， 2017， 硕士

【摘要】 近年来,云计算技术得到了快速的发展与应用,云计算服务越来越受到企业和个人的欢迎。云存储是目前使用最广泛的云计算服务之一。然而,云存储服务在为用户带来便利的同时,也引发了一系列的安全问题,犯罪分子可能滥用云存储服务来实施犯罪。因此,针对云存储的数字取证技术研究具有重要意义。而云存储用户端设备上存在着用户使用云存储时留下的痕迹信息,对云存储用户端进行取证能够获得大量有利于案件调查的证据信息。本文以百度网盘这一国内主流的云存储服务为例,研究了针对云存储用户端的数字取证关键技术。本文主要的研究工作如下:1.首先介绍了痕迹分析的方法,之后研究了在Windows 7系统下使用百度网盘这一云存储服务时留下的痕迹,分析了通过浏览器方式和百度网盘客户端程序方式访问并操作百度网盘时在磁盘上留下的痕迹,分析了痕迹的位置、痕迹文件的格式和内容以及能够从中提取的证据信息。分析发现,痕迹中包含用户账号、用户操作记录、操作时间、文件名、哈希值等重要信息,同时也发现客户端程序的账号信息文件中的数据经过加密存储,需要研究从中获取信息的方法。2.针对百度网盘客户端程序将用户账号密码信息加密存储在账号信息文件中的情况,本文通过逆向分析技术对百度网盘客户端程序进行了逆向分析。首先介绍了逆向分析的基本方法,之后分析了百度网盘客户端程序解密账号信息文件的机制以及解密密钥的生成方式,实现了对账号信息文件中加密存储的账号密码信息的解密和获取。3.针对痕迹文件中具有大量的SQLite数据库文件的情况,本文在研究SQLite数据库文件结构的基础上,研究了恢复SQLite数据库中已删除数据的原理与方法,提出了一种基于特征匹配和SVM分类器的数据恢复方法,能够针对已知的表进行数据恢复。该方法首先根据数据库文件结构,从自由块、自由页以及所有页面的未分配空间中获取已删除数据区域,然后使用特征匹配方法从获取的已删除数据区域中定位数据单元,最后使用基于SVM分类器的数据恢复方法从单元中恢复数据。该方法能够有效提高数据恢复的恢复率与准确率。4.最后,在上述研究基础上,设计实现了一个针对云存储用户端的数字取证系统,实现了对百度网盘的用户端取证。本文对于百度网盘的分析方法可以为其他云存储系统的取证分析提供有益的参考。更多还原

【Abstract】 In recent years,cloud computing technology has got rapid development.Cloud computing services are increasingly applied by businesses and individuals.Cloud storage is one of the most widely used cloud computing services.However,when cloud storage service brings convenience for the users,it also led to a series of security problems at the same time.Criminals may abuse cloud storage service to commit crimes.Therefore,the research on digital forensics technology for cloud storage is of great significance.Moreover,doing digital forensic on the cloud storage client can obtain a large number of evidence information which is beneficial to the case investigation.The key technologies of digital forensics for cloud storage was researched in this thesis,using baidu netdisk which is a domestic mainstream cloud storage services as a case.The main works of this thesis are presented as follows.1.Based on the trace analysis technologies,we analyze the use traces of baidu netdisk which is a kind of cloud storage service on the Windows 7 system.The traces of the use of baidu netdisk through the browsers and the client application existed in the devices was analyzed in this thesis.This thesis describes where traces exist in the client devices and how these traces should be analyzed.The user accounts and user operation records,operation time,file name,hash value and other important information can be found through analysis of the traces.The research of the traces found that the client account information in the file was encrypted.It was needed to research the method of getting account information.2.The client application program of baidu netdisk was analyzed through the reverse analysis technology to find the mechanism of the application to decrypt the account information file stored on the local devices.Firstly,the basic method of reverse analysis was introduced,and then the mechanism of decrypting the account information file as well as generating the decryption key was analyzed in this thesis.3.The research of SQLite database data recovery is necessary in the case of a lot of SQLite database files exist in the traces.The principle and method of the SQLite database data recovery was researched in this thesis based on the research of the SQLite database file structure.A method of SQLite database data recovery based on feature matching and SVM classification which can recovery deleted data from known table in the database was proposed in this thesis.The method first retrieves the deleted data area from the freeblocks,the freelist pages and the unallocated space of all the pages according to the database file structure,and then locates the data cell from the acquired deleted area through the method of feature matching,and finally recovers data from the data cell through the method of data recovery based on SVM classification.The recovery rate and accuracy of data recovery can be improved efficiently by using the method proposed in this thesis.4.The design of a digital forensics system for cloud storage client side based on the above research is described.The method of analyzing baidu netdisk in this thesis can provide useful reference for forensic analysis of other cloud storage system.更多还原