关键词: 黑莓, 文件系统, 解析, 取证, 逻辑单元

Abstract: This paper describes a it to form a logical unit and the contents of the file to start the mapping file by the specific content of the general rules of the system analysis method, and stored in the directory structure of files and other information structures unfold, and ultimately get the basic structure of the file system and the various kinds of parameters to achieve a written argument based on manual semi-manual analytical techniques. In addition it can be used to parse the file system in general, and more importantly applied to the unknown file system - direct data file system mirroring BlackBerry resolution. By application of this method can be more in-depth understanding of the general rules of the file system, the file system to improve analytical thinking, and to master certain BlackBerry file systems thinking, and finally realize the mirror BlackBerry forensics.

Key words: BlackBerry, file system, analytical, forensics, logical unit