Windows平台下iOS设备取证方法研究-数字取证专业论文.docxVIP

万方数据 万方数据 Abstract With the popularity of mobile devices as well as highly developed smartphone operating system, Apples iOS operation system has accounted for most of the mobile device market share. At the same time, the phenomenons of crime through iOS devices or as target are increasingly common. The Windows OS as the most widely used desktop operating system, so the research of digital forensic technology and design of digital forensics system for iOS devices based on Windows OS has both strong theoretical and practical values. In this paper, through analyzing the iOS App’s basic characteristics: rapid growth and constantly updated, we analyzed the data from default App and the third-party download App. Combined with the actual evidence requirements, we designed and implemented the App data acquisition module and analysis module that based on dynamic plug-in mechanism which flexible to adapt to the changing needs of the App itself and digital forensics. Also analyzed two kinds of iOS devices backup: iTunes and iCould backup, and elaborated the access to backup data and analytical methods. On the basis of above technology, we presented fuzzy approach of iOS devices and discusses the application scenarios, effect of the backups’s time attribute of the method. At last, we made a backup’s time property validation methods. After obtaining the result set, for the needs of search function, we propose a matching algorithm combined limited attribute fields search with AC multi-mode search algorithm which improved search function and efficiency. Combination of these theoretical and technical points, the forensics system for iOS devices was designed and implemented based on Windows OS which solve the most practical problems during digital forensics works. Key words: iOS Device, Digital Forensics, Plug-in Analysis, iOS Backups, AC Algorithm II 目录 HYPERLINK \l _bookmark0 第一章 绪论 1 HYPERLINK \l _bookmark1 1.1 移动设备取证研究背景与意义 1 HYPERLINK \l _bookmark2 1.2 国内外 iOS 设备取证研究现状比