巧用MTP协议破解Android智能手机屏幕锁密码

本文介绍了基于Android平台的智能手机应用MTP协议[1]在PC机构建的一个虚拟文件系统[2]中进行案件检验的实例。涉案手机因设置了手机防盗锁且USB调试未打开,现有的手机取证工具无法对其数据进行提取。通过查询手机生产日期推断该手机版本支持MTP协议,并尝试利用MTP协议查看和拷贝手机内的文件,最终找到QQ文件夹下保存的解锁密码,解除屏幕锁后利用现有手机取证工具成功提取到涉案手机中的短信息、即时通讯记录等与案件相关的信息,为手机检验中破解第三方软件设置的屏幕锁解锁提供了一种新的方法。     

手机取证研究概述

司法实践中,越来越多的案件需要从手机中提取各种信息,手机已经成为电子物证检验的新对象.本文结合手机取证的特点,讨论了手机犯罪、手机电子数据和手机取证的相关问题.     

浅谈手机取证在检察工作中的应用

随着科学技术的不断发展和应用的不断推广，手机在人们日常生活中发挥越来越大的作用，手机取证也逐渐成为司法实践活动中的重要手段之一。文章从检察机关执法办案中开展手机取证工作的必要性出发，通过对近年来手机取证工作在检察机关开展现状的介绍，分析、总结了手机取证工作遇到的困难，并对今后手机取证工作开展的方向提出了建议。     

从“1107”专案谈固体废物走私的电子数据取证

"1107"专案系全国海关开展"绿篱"专项行动以来查获的最大宗固体废物走私犯罪案件。办案部门获取的电子证据涵盖了办公文档、照片、音视频资料、电子邮件、IM聊天记录、手机通讯录和手机短信等诸多类型。取证方式使用单机本地、网络远程和手机提取等多种方法。分析该案的信息化犯罪特征,研究其电子数据取证模式,对于构建走私固体废物案件取证体系,具有重要的实证意义。     

利用物理检测技术提取高仿nokian8手机机身数据的方法

近年来，手机的取证工作已成为电子物证专业的一项重要内容。手机内所存储的通讯信息，图片信息、多媒体信息为侦破案件的工作提供了重要的线索。据笔者统计某市近两年检验的案件，在涉案手机中，国产山寨机的数量占一半以上。对于国产山寨手机的检验而言，通常方法是先获取到手机机身内存的镜像文件，然后对其进行解析。所以检验的关键是如何提取到手机内存的镜像文件。     

不同取证系统对手机微信聊天记录恢复效果的比较分析

在对新型涉网犯罪的打击过程中,犯罪嫌疑人手机数据的采集是取证的关键环节,而在实战中,手机中存在至关重要线索和证据的微信聊天记录通常会被删除。如何能够快速、高效地恢复犯罪嫌疑人手机中已删除的微信聊天记录,是相关案件侦查过程中面临的亟待解决的问题。本文采用了目前最普遍使用的四款取证系统的最新版本,分别对当下主流的三十余款型号的华为和苹果手机进行微信数据采集,并在第一次采集完成后,对旧系统版本的实验手机进行系统升级后再次采集数据,以此比对分析不同取证系统恢复华为、苹果手机已删除微信聊天记录的效果。本文能为相关案件侦办中取证工具的选择提供参考。     

Windows Phone 7智能手机的取证

作为新兴的智能手机,Windows Phone手机呈稳步发展趋势,并越来越受到人们的关注.在介绍了WindowsPhone 7手机的系统架构和安全模型后,就取证遇到的问题详细地描述了取证方式,探讨了如何对Windows Phone 7智能手机进行取证.通过使用原生级方法和Windows Phone SDK访问Window Phone 7内核和其他数据来获得手机的有价值信息,同时通过一系列工具来分析手机上的文件.结果表明,能够从Windows Phone 7手机中有效寻找到短信、电子邮件、社交活动等证据资料.     

Android智能手机的取证

作为一种新兴的智能手机,Android手机发展势头极为迅猛,并越来越多的受到人们的关注。通过对Android智能手机的取证研究,在介绍了Android手机的基本工作原理后,详细描述了取证方式。通过Android SDK工具对手机内外置存储进行镜像备份,逻辑分析利用文件系统分析,查找每个应用程序自带的数据库文件来获得有价值信息,物理分析通过对内存镜像进行数据恢复以寻找删除的文件,两者互相结合。结果表明,能够从Android手机中有效寻找到潜在证据。     

国产及山寨手机中QQ聊天记录恢复、提取的探讨

通过分析国产及山寨手机的软件结构特征,发现QQ数据的存储规律,结合实例介绍在国产手机、山寨手机上应用取证分析工具对QQ数据进行解析、提取的步骤、方法。     

法律如何应对银行卡短信欺诈

通过法律的形式对短信息服务和使用行为进行规范,要埘利用手机短信息传播欺诈等有害信息的行为苛以相应的法律责任,加大其犯罪成本：要加强对个人信息的保护,打击侵害个人信息的行为。     

手机物证检验及其在刑事侦查中的应用

随着移动通信技术的迅速发展和广泛应用,手机内部包含的信息已经成为犯罪侦查重要的线索和证据来源。采用专门的符合物证鉴定原理要求的技术方法检验手机的SIM卡存储器、主板存储器和闪存卡,可以获得大量的手机使用者个人信息、通信内容信息、通信发生信息、使用者写入存储信息和手机设置信息等大量信息资料。手机检验结果给出的这些信息具有非常高的侦查和证据价值的,手机也因此成为物证鉴定领域内一个新的检验对象。     

手机通话语音的实验研究

当前,手机通话语音已成为司法语音鉴定中最为常见的一种语音形式。本研究从手机通信系统的信道特点出发,分析手机通话语音的声谱特点和共振峰频率变化等情况;同时还比较了不同通话网络、不同通话方式及不同手机的通话语音特点。实验发现,手机通话语音与直接录音语音有明显的变化,主要表现在高低频信息的带宽滤波效应、高低频共振峰的漂移、语音质量、音色、韵律特征等方面;还发现,不同手机通话条件下的语音变化程度不同。最后,讨论了手机通话语音变化对说话人鉴定的影响及鉴定中的注意事项。     

Investigating the uses of mobile phone evidence in China criminal proceedings

Data from mobile phones are regularly used in the investigation of crime and court proceedings. Previously published research has primarily addressed technical issues or provided operational manuals for using forensic science evidence, rather than analysing human factors and the implementation of forensic tools in investigation settings. Moreover, previous research has focused almost entirely on western countries, and there is a dearth of research into the uses of forensic evidence in China. In this study, a review was carried out of court sentencing documents referring to mobile phone evidence in China over the period 2013–2018. Automated content analysis was used to identify the specific evidence types utilised and the sentencing outcome for each case. Results show that mobile phone evidence was used in 3.3% of criminal proceedings. Among various data types mentioned in criminal proceedings, call records sustained as the most frequently used type of data. After which, instant messaging tools (e.g. WeChat) are an increasing proportion of all mobile phone evidence, from 1% in 2015 to 25% in 2018. For cases that utilised mobile phone data, the analysis of instant messaging and online transaction tools is routine, with little variation in the use of each application (WeChat, Alipay, QQ) for investigations of different types of crime. However, in the majority of criminal cases, mobile phone data function as subsidiary evidence and posed limited impacts on verdict reached. The current findings indicate that a large amount of mobile phone evidence was transformed into other evidence formats or filtered out directly before court proceedings.     

Live memory forensics of mobile phones

In this paper, we proposed an automated system to perform a live memory forensic analysis for mobile phones. We investigated the dynamic behavior of the mobile phone’s volatile memory, and the analysis is useful in real-time evidence acquisition analysis of communication based applications. Different communication scenarios with varying parameters were investigated. Our experimental results showed that outgoing messages (from the phone) have a higher persistency than the incoming messages. In our experiments, we consistently achieved a 100% evidence acquisition rate with the outgoing messages. For the incoming messages, the acquisition rates ranged from 75.6% to 100%, considering a wide range of varying parameters in different scenarios. Hence, in a more realistic scenario where the parties may occasionally take turns to send messages and consecutively send a few messages, our acquisition can capture most of the data to facilitate further detailed forensic investigation.     

Identification of Mobile Phone and Analysis of Original Version of Videos through a Delay Time Analysis of Sound Signals from Mobile Phone Videos

This study designs a method of identifying the camera model used to take videos that are distributed through mobile phones and determines the original version of the mobile phone video for use as legal evidence. For this analysis, an experiment was conducted to find the unique characteristics of each mobile phone. The videos recorded by mobile phones were analyzed to establish the delay time of sound signals, and the differences between the delay times of sound signals for different mobile phones were traced by classifying their characteristics. Furthermore, the sound input signals for mobile phone videos used as legal evidence were analyzed to ascertain whether they have the unique characteristics of the original version. The objective of this study was to find a method for validating the use of mobile phone videos as legal evidence using mobile phones through differences in the delay times of sound input signals.     

九成国产手机或被淘汰

如果不能顺应3G手机和智能手机（智能3G手机）的发展潮流，九成的国产品牌手机将面临被市场淘汰的风险     

Forensic Inspection of Sensitive User Data and Artifacts from Smartwatch Wearable Devices

Wearable devices allow users the ability to leave mobile phones behind while remaining connected to the digital world; however, this creates challenges in the examination, acquisition, identification, and analysis of probative data. This preliminary research aims to provide an enhanced understanding of where sensitive user data and forensic artifacts are stored on smartwatch wearable devices, both through utilization as a connected and standalone device. It also provides a methodology for the forensically sound acquisition of data from a standalone smartwatch wearable device. The results identify significant amounts of data on the Samsung^? Gear S3 Frontier, greater than that stored on the companion mobile phone. An Apple Watch^® Series 3 manual examination method which produces native screenshots was identified; however, the companion mobile phone was found to store the greatest amount of data. As a result of this research, a data extraction tool for the Samsung^? Gear S3 Frontier was created.     

Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.     

An Android Communication App Forensic Taxonomy

Due to the popularity of Android devices and applications (apps), Android forensics is one of the most studied topics within mobile forensics. Communication apps, such as instant messaging and Voice over IP (VoIP), are one popular app category used by mobile device users, including criminals. Therefore, a taxonomy outlining artifacts of forensic interest involving the use of Android communication apps will facilitate the timely collection and analysis of evidentiary materials from such apps. In this paper, 30 popular Android communication apps were examined, where a logical extraction of the Android phone images was collected using XRY, a widely used mobile forensic tool. Various information of forensic interest, such as contact lists and chronology of messages, was recovered. Based on the findings, a two‐dimensional taxonomy of the forensic artifacts of the communication apps is proposed, with the app categories in one dimension and the classes of artifacts in the other dimension. Finally, the artifacts identified in the study of the 30 communication apps are summarized using the taxonomy. It is expected that the proposed taxonomy and the forensic findings in this paper will assist forensic investigations involving Android communication apps.     

Establishing phone-pair co-usage by comparing mobility patterns

In forensic investigations it is often of value to establish whether two phones were used by the same person during a given time period. We present a method that uses time and location of cell tower registrations of mobile phones to assess the strength of evidence that any pair of phones were used by the same person. The method is transparent as it uses logistic regression to discriminate between the hypotheses of same and different user, and a standard kernel density estimation to quantify the weight of evidence in terms of a likelihood ratio. We further add to previous theoretical work by training and validating our method on real world data, paving the way for application in practice. The method shows good performance under different modeling choices and robustness under lower quantity or quality of data. We discuss practical usage in court.