mtk手机flash芯片文件系统恢复研究 the research of mtk mobile phohes flash filesystem recovery.pdfVIP

。 2010．11＼ 器霎篙砉I合作厦门美亚柏科1日” ■doi：10．3969／j．issn．1671．1122．2010．11．011 M las TK季礼F h 系统恢 张志伟 The of mobile Flash researchMTK phohesfilesystemrecovery Zhi．wei Zhang (XiamenPico 361008，China) MeiyaInformaionCo．，Ltd．，Fujian，Xiamen Abstract：Currentforensictoolsforexaminationmobile dataextractionona phonesmostlyperform levelanddonotconsiderthe of media data alowlevel logical typestorage duringanalysis．Thispapersuggests fortheforensicexaminationofflashmemoriesanddescribesthreelow—leveldata methods approach acquisition for full offlash devices．FordifferentMediaTekmobile isshownhow memory making copies memory phones fIlil oftheirflashmemoriesCanbemadeandwhich arcneededtotranslatetheextracted memorycopies steps dataintoaformatthatcanbeunderstoodcommonforensicmedia tools．And mobile by analysis recoveryphones ete． phonebook，sms，image Keywords：MTK；Flashmemory；Recovery 0引言 目前，Flash闪存在消费类电子产品上采用非易失性固态存储技术仍处于主导地位，随着嵌入式技术的发展，越来越多的嵌 入