Android智能手机动态内存取证技术综述

doi:10.3969/j.issn.1671-1122.2019.02.002

信息网络安全 ›› 2019, Vol. 19 ›› Issue (2): 10-17.doi: 10.3969/j.issn.1671-1122.2019.02.002

Android智能手机动态内存取证技术综述

丁丽萍^1,², 刘雪花^1,³(), 陈光宣^1,⁴, 李引²

1.中国科学院软件研究所,北京 100190
2.广州中国科学院软件应用技术研究所,广东广州 511458
3.中国科学院大学,北京100049
4.浙江警察学院,浙江杭州 310053

收稿日期:2018-12-10 出版日期:2019-02-10 发布日期:2020-05-11
作者简介:
作者简介：丁丽萍（1965—）,女,山东,研究员,博士,主要研究方向为系统安全、电子数据取证;刘雪花（1985—）,女,湖南,博士研究生,主要研究方向为信息安全、电子数据取证;陈光宣（1984—）,男,浙江,讲师,博士,主要研究方向为信息安全、电子数据取证;李引（1981—）,男,北京,高级工程师,博士,主要研究方向为云计算、大数据、区块链。
基金资助:
国家自然科学基金[11502275];江西省经济犯罪侦查与防控技术协同创新中心开放基金资助课题[JXJZXTCX-009, JXJZXTCX-007];广东省省级科技计划项目[2017B050506002];广州市科技计划项目[201802020015, 201610010092];羊城创新创业领军人才支持计划[2016008];NSFC-浙江两化融合联合基金[U1509219]

Overview of Digital Forensics Technologies of RAM in Android Devices

Liping DING^1,², Xuehua LIU^1,³(), Guangxuan CHEN^1,⁴, Yin LI²

1.Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
2. Institute of Software Application Technology, Guangzhou & Chinese Academy of Sciences, Guangzhou Guangdong 511458, China
3.University of Chinese Academy of Sciences, Beijing 100049, China
4.Zhejiang Police College,Hangzhou Zhejiang 310053, China

Received:2018-12-10 Online:2019-02-10 Published:2020-05-11

摘要/Abstract

摘要：

不同于静态内存中敏感数据被加密存储,Android动态内存中一些敏感信息以明文的形式存在,如应用程序账户、密码、加密密钥以及一些缓存的应用数据等,这些数据具有极大的取证价值。而且随着智能手机动态内存容量的不断增大,越来越多的应用数据被缓存至动态内存中,针对Android智能手机动态内存的电子数据取证研究具有重要意义。文章分析对比了LiME及其改进方法、FROST、MEMGRAB及其改进方法、硬件提取方法等主要的Android智能手机动态内存提取技术,分析了进程分析、系统信息分析、密钥分析、账号密码和应用缓存数据分析等主流的Android智能手机动态内存分析技术。文章通过分析得出了这些方法存在的问题和不足并提出未来研究方向的建议,以帮助取证人员更好地开展Android智能手机的取证工作。

关键词: Android, 智能手机, 动态内存, 电子数据取证

Abstract:

Different from the sensitive data in static memory being encrypted and stored, some sensitive data in Android dynamic memory exists in the form of plaintext, such as application account, password, encryption key and some cached application data, which have great forensics value. In addition, with the increasing capacity of dynamic memory of smart phones, more and more application data are cached in the dynamic memory, the forensics research on the dynamic memory of Android smart phones is of great significance. This article analyzed and compared several Android smartphones dynamic memory extraction technologies, such as LiME, improved LiME, FROST, MEMGRAB, improved MEMGRAB and hardware extraction method, and several Android smartphone dynamic memory analysis technologies, such as process analysis, system information analysis, encryption key analysis, application account and password analysis. It is concluded that these methods have deficiencies in applicability, efficiency or operability. Through analyzing the weakness of these digital forensics technologies, this article gave some improvement advices and future research directions. The work of this article is able to benefit digital forensics practice of Android devices.

Key words: Android, smart phone, RAM, digital forensics

中图分类号:

TP309

丁丽萍, 刘雪花, 陈光宣, 李引. Android智能手机动态内存取证技术综述[J]. 信息网络安全, 2019, 19(2): 10-17.

Liping DING, Xuehua LIU, Guangxuan CHEN, Yin LI. Overview of Digital Forensics Technologies of RAM in Android Devices[J]. Netinfo Security, 2019, 19(2): 10-17.

图/表 6

图1

图2

图3

图4

图5

图6

参考文献 20

[1]	LESSARD J, KESSLER G.Android Forensics: Simplifying Cell Phone Examinations[J]. Small Scale Digital Device Forensics Journal, 2010, 4(1): 1-12.
[2]	HOOG A.Android Forensics: Investigation, Analysis and Mobile Security for Google Android[M].Waltham: Elsevier, 2011.
[3]	LIU Haoyang, Research on Android Device Forensic[J]. Netinfo Security,2015,15(9):29-32.
	刘浩阳. Android设备取证研究[J]. 信息网络安全,2015,15(9):29-32.
[4]	HERIYANTO A P.Procedures and Tools for Acquisition and Analysis of Volatile Memory on Android Smart Phones[C]//Edith Cowan University. The 11th Australian Digital Forensics Conference. December 2-4,2013, Perth, Western Australia. Perth: The Security Research Centre, Edith Cowan University, 2013: 84-95.
[5]	ANGLANO C.Forensic Analysis of WhatsApp Messenger on Android Smart Phones[J]. Digital Investigation, 2014, 11(3): 201-213.
[6]	ANGLANO C, CANONICO M, GUAZZONE M.Forensic Analysis of the Chat Secure Instant Messaging Application on Android Smart Phones[J]. Digital Investigation, 2016,19(10): 44-59.
[7]	WU S, ZHANG Y, WANG X, et al.Forensic Analysis of WeChat on Android Smart Phones[J]. Digital Investigation, 2017, 21(6): 3-10.
[8]	DO Q, MARTINI B, CHOO K K R. A Cloud-focused Mobile Forensics Methodology[J]. IEEE Cloud Computing, 2015, 2(4): 60-65.
[9]	MALIK R, SHASHIDHAR N, CHEN L.Cloud Storage Client Application Evidence Analysis on UNIX/Linux[C]// IEEE. International Conference on Security and Management (SAM). July 27-30, 2015, Las Vegas. New York: IEEE, 2015: 111-117.
[10]	CAHYANI N D W, RAHMAN N H A, GLISSON W B, et al. The Role of Mobile Forensics in Terrorism Investigations Involving the Use of Cloud Storage Service and Communication APPs[J]. Mobile Networks and Applications, 2017, 22(2): 240-254.
[11]	SYLVE J, CASE A, MARZIALE L, et al.Acquisition and Analysis of Volatile Memory from Android Devices[J]. Digital Investigation, 2012, 8(3): 175-184.
[12]	CHEN Long, MAO Yue.Forensic Analysis of Email on Android Volatile Memory[C]//IEEE. The 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications. August 23-26,2016, Tianjin, China. New York: IEEE, 2016: 945-951.
[13]	KANG Yanrong, FAN Wei, ZHAO Lu, et al.Acquisition of Live Memory from Android Phones Based on Similar Kernel[J]. Forensic Science and Technology, 2018, 43(2):92-96
	康艳荣,范玮,赵露,等,基于相似内核的Android手机动态内存提取技术研究[J].刑事技术,2018,43(2):92-96.
[14]	SCHEICK L Z,GUERTIN S M,SWIFT G M.Analysis of Radiation Effects on Individual DDRAM Cells[J].IEEE Trans on Nuclear Science,2000,47( 6) : 2534-2538.
[15]	MÜLLER T, SPREITZENBARTH M. Frost[C]// ACNS. The 11th International Conference on Applied Cryptography and Network Security, June 25-28, 2013, Banff, AB, Canada. Berlin Heidelberg: Springer, 2013: 373-388.
[16]	THING V L L, NG K Y, CHANG E C. Live Memory Forensics of Mobile Phones[J]. Digital investigation, 2010, 7(8): S74-S82.
[17]	XU Naiyang.Research and Realization of Android System Simulation and Memory Forensics[D]. Nanjing: Southeast University, 2017.
	徐乃阳. Android系统仿真与内存取证技术的研究与实现[D].南京:东南大学,2017.
[18]	APOSTOLOPOULOS D, MARINAKIS G, NTANTOGIAN C, et al.Discovering Authentication Credentials in Volatile Memory of Android Mobile Devices[C]//IFIP. Conference on e-Business, e-Services and e-Society. April 25-26, 2013, Athens, Greece. Berlin Heidelberg: Springer, 2013: 178-185.
[19]	ZHOU F, YANG Y, DING Z, et al.Dump and Analysis of Android Volatile Memory on Wechat[C]//IEEE. IEEE International Conference on Communications, June 8-12 2015,London, UK. New York: IEEE, 2015: 7151-7156.
[20]	LI Qiang, LIU Baoxu, JIANG Zhengwei, et al.Analysis of Model of QQ Forensic in Android System[J]. Netinfo Security, 2016, 16(1): 40-44.
	李强,刘宝旭,姜政伟,等. 一种Android系统下的QQ取证模型分析[J]. 信息网络安全,2016,16(1):40-44.

Android智能手机动态内存取证技术综述

Overview of Digital Forensics Technologies of RAM in Android Devices

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 6

参考文献 20

相关文章 15

编辑推荐

Metrics

本文评价

[1]	侯留洋, 罗森林, 潘丽敏, 张笈. 融合多特征的Android恶意软件检测方法[J]. 信息网络安全, 2020, 20(1): 67-74.
[2]	宋鑫, 赵楷, 张琳琳, 方文波. 基于随机森林的Android恶意软件检测方法研究[J]. 信息网络安全, 2019, 19(9): 1-5.
[3]	宋新龙, 郑东, 杨中皇. 基于AOSP与SELinux的移动设备管理系统[J]. 信息网络安全, 2017, 17(9): 103-106.
[4]	陆德冰, 崔浩亮, 张文, 牛少彰. 基于Intent过滤的应用安全加固方案[J]. 信息网络安全, 2017, 17(11): 67-73.
[5]	刘佳佳, 俞研, 胡恒伟, 吴家顺. 一种基于虚拟机定制的应用保护方法研究[J]. 信息网络安全, 2017, 17(1): 63-67.
[6]	刘浩阳. MS SQL数据库在线取证研究[J]. 信息网络安全, 2016, 16(9): 26-30.
[7]	韩马剑. 路由器取证研究[J]. 信息网络安全, 2016, 16(9): 51-55.
[8]	文伟平, 汤炀, 谌力. 一种基于Android内核的APP敏感行为检测方法及实现[J]. 信息网络安全, 2016, 16(8): 18-23.
[9]	余丽芳, 杨天长, 牛少彰. 一种增强型Android组件间安全访问控制方案[J]. 信息网络安全, 2016, 16(8): 54-60.
[10]	曲乐炜, 罗森林, 孙志鹏, 朱帅. Android系统数据完整性检测方法研究[J]. 信息网络安全, 2016, 16(8): 61-67.
[11]	张家旺, 李燕伟. 基于N-gram算法的恶意程序检测系统研究与设计[J]. 信息网络安全, 2016, 16(8): 74-80.
[12]	杨静雅, 罗森林, 朱帅, 曲乐炜. 基于多层次交叉视图分析的Android系统恶意行为监控方法研究[J]. 信息网络安全, 2016, 16(7): 40-46.
[13]	李亚萌, 何泾沙. 基于Hash的YAFFS2文件各版本恢复算法研究[J]. 信息网络安全, 2016, 16(5): 51-57.
[14]	文伟平, 张汉, 曹向磊. 基于Android可执行文件重组的混淆方案的设计与实现[J]. 信息网络安全, 2016, 16(5): 71-77.
[15]	丁庸, 曹伟, 罗森林. 基于LKM系统调用劫持的恶意软件行为监控技术研究[J]. 信息网络安全, 2016, 16(4): 1-8.