Fiche du document
25 mars 2013
- handle: 10670/1.zrxvwp
- hal: hal-01480183
- doi: 10.1007/978-3-642-36818-9_30
Ce document est lié à :
info:eu-repo/semantics/altIdentifier/doi/10.1007/978-3-642-36818-9_30
http://creativecommons.org/licenses/by/ , info:eu-repo/semantics/OpenAccess
Mots-clés
Digital forensics Android YAFFS2 SQLite RecoverySujets proches
Frontier troubles AnnalsCiter ce document
Beibei Wu et al., « A Recovery Approach for SQLite History Recorders from YAFFS2 », HAL-SHS : sciences de l'information, de la communication et des bibliothèques, ID : 10.1007/978-3-642-36818-9_30
Métriques
Partage / Export
Résumé
Nowadays, forensic on flash memories has drawn much attention. In this paper, a recovery method for SQLite database history records (I.e. updated and deleted records) form YAFFS2 is proposed. Based on the out-of-place-write strategies in NAND flash memory required by YAFFS2, the SQLite history recorders can be recovered and ordered into timeline by their timestamps. The experiment results show that the proposed method can recover the updated or deleted records correctly. Our method can help investigators to find the significant information about user actions in Android smart phones by these history recorders, although they seem to have been disappeared or deleted.