CAJ | 학술논문

本文介绍了对 Android 手机物理内存镜像进行关键字搜索获取删除短信数据的案件检验实例。本案中嫌疑人已对涉案手机进行了数据删除操作，现有手机取证工具只能获取部分删除短信数据。但通过获取该手机物理存储镜像，并结合案情选定关键词对镜像进行关键字搜索，最终提取到了与案件相关的删除短信数据，为Android 手机检验中删除短信检验提供了一种新的方法。
본문개소료대 Android 수궤물리내존경상진행관건자수색획취산제단신수거적안건검험실례。본안중혐의인이대섭안수궤진행료수거산제조작，현유수궤취증공구지능획취부분산제단신수거。단통과획취해수궤물리존저경상，병결합안정선정관건사대경상진행관건자수색，최종제취도료여안건상관적산제단신수거，위Android 수궤검험중산제단신검험제공료일충신적방법。
This paper introduces a digital forensic examination on storage dump from an Android smart phone to access the deleted SMS data. The SMS data had been deleted by the suspect from the Android smart phone. Part of the deleted SMS data could be recovered using DC-4500 mobile phone forensic system and Oxygen Forensic Suite 2014, but proved to be irrelevant to the case. Commonly, the above software can only analyze the SMS database file, thus the deleted data would no longer exist in the SMS database if the sqlite database had already recycled the storage space. Therefore, a new inspection method was deployed to access the deleted SMS data. At first, the Android phone was rooted and its hex-dump got with DC-4500 mobile phone forensic system, and then some keywords were selected and searched through the hex-dump by X-Way Forensics. Subjected to further analysis, the evidentially deleted SMS data fragment that the suspects tried to destroy after committing their crime, was finally found in the free space of hex-dump. Currently, Android smart-phones involved in cases are even more commonly emerging, resulting in the ever-increased necessity to get relevant hex-dumps from the phones and obtain data through keyword-searching into them. The method of this paper could be taken as a reference for future work.