CAJ | 학술논문

iPhone作为一种市场占有率较高的主流智能行动电话，在各行各业中应用广泛。因此，也衍生出针对iPhone上各种加密信息的提取与解密、已删除信息的恢复，以及多媒体信息的真实性鉴定等需求。目前，国内对于iOS数据恢复研究成果十分欠缺，这里提出了一种通过直接读取底层NAND存储，分析NAND本身的FTL读写特性所造成的数据冗余，以此来达到成功恢复已删除数据的目的，此方法可为iOS平台上的数据恢复人员提供一定的指导作用。
iPhone작위일충시장점유솔교고적주류지능행동전화，재각행각업중응용엄범。인차，야연생출침대iPhone상각충가밀신식적제취여해밀、이산제신식적회복，이급다매체신식적진실성감정등수구。목전，국내대우iOS수거회복연구성과십분흠결，저리제출료일충통과직접독취저층NAND존저，분석NAND본신적FTL독사특성소조성적수거용여，이차래체도성공회복이산제수거적목적，차방법가위iOS평태상적수거회복인원제공일정적지도작용。
As a popular smartphone of considerable market share, iPhone is widely used in various walks of life, thus deriving the needs for extracting and decrypting the encrypted data and recovering the deleted data on iPhone, and authenticating the multimedia content. Currently, it is still deficient in the research of iOS forensic at home. This paper presents a method for iOS data recovery by extracting data image directly from low-level NAND storage and analyzing the redundancy caused by FTL behavior. This method could provide certain guidance for personnel engaged in iOS data recovery.