CAJ | 학술논문

文章阐述了一种由具体内容映射文件系统一般规律的分析方法，从逻辑单元和文件内容的组成入手，从文件目录和其它信息结构的存储结构展开，最终得到文件系统的基本结构和各种参数，实现了基于手动写入参数的半手工解析技术。文中技术除了可以用于一般文件系统的解析，更重要的是可以应用于未知文件系统-黑莓文件系统的直接数据镜像解析。通过这种方法的应用，可以更深入理解文件系统的一般规律，完善文件系统解析的思路，并掌握一定的黑莓文件系统思想，最后实现黑莓手机镜像的取证。
문장천술료일충유구체내용영사문건계통일반규률적분석방법，종라집단원화문건내용적조성입수，종문건목록화기타신식결구적존저결구전개，최종득도문건계통적기본결구화각충삼수，실현료기우수동사입삼수적반수공해석기술。문중기술제료가이용우일반문건계통적해석，경중요적시가이응용우미지문건계통-흑매문건계통적직접수거경상해석。통과저충방법적응용，가이경심입리해문건계통적일반규률，완선문건계통해석적사로，병장악일정적흑매문건계통사상，최후실현흑매수궤경상적취증。
This paper describes a it to form a logical unit and the contents of the ifle to start the mapping ifle by the speciifc content of the general rules of the system analysis method, and stored in the directory structure of files and other information structures unfold, and ultimately get the basic structure of the ifle system and the various kinds of parameters to achieve a written argument based on manual semi-manual analytical techniques. In addition it can be used to parse the ifle system in general, and more importantly applied to the unknown ifle system-direct data ifle system mirroring BlackBerry resolution. By application of this method can be more in-depth understanding of the general rules of the ifle system, the ifle system to improve analytical thinking, and to master certain BlackBerry ifle systems thinking, and ifnally realize the mirror BlackBerry forensics.