CAJ | 학술논문

针对基于MTK平台和NAND Flash的山寨手机进行了手机取证技术研究，通过逆向工程解析了手机中关键数字证据（通话记录与网页浏览记录）的物理层数据格式，进一步研究复杂操作下这两种关键数字证据在山寨手机中的存储管理机制和取证技术。对于被删除的数据记录，可以通过对底层二进制数据的详细分析进行检测，并依据数据存储特征进行恢复。
침대기우MTK평태화NAND Flash적산채수궤진행료수궤취증기술연구，통과역향공정해석료수궤중관건수자증거（통화기록여망혈류람기록）적물리층수거격식，진일보연구복잡조작하저량충관건수자증거재산채수궤중적존저관리궤제화취증기술。대우피산제적수거기록，가이통과대저층이진제수거적상세분석진행검측，병의거수거존저특정진행회복。
MTK-based pirated phone with NAND flash was analyzed and the related forensics techniques were studied. The physical storage format of two key digital evidences ( call record and web history) in pirated phone was analyzed and parsed using reverse engineering. Based on this, the storage mechanism and forensics techniques for the two digital evidences with complicated operations were studied. The results showed that purposely deleting operation could be detected by analyzing low-level binary image. Furthermore, some of the records could be successfully re-trieved.