基于IOS缩略图文件的数据恢复研究和开发

Study and development of data recovery based on IOS thumbnail file

i Phone Operating System(IOS)的缩略图文件(后缀为ithmb)保存了图像的重要信息,通过解读其数据结构能够恢复出已删除图片的缩略图,从而为IOS移动设备的调查取证提供关键的证据和线索。分析了ithmb文件的作用,结合BMP文件格式阐述了利用ithmb文件来恢复出缩略图的原理,开发出ithmb分析软件实现缩略图的恢复。

iPhone Operating System （IOS） thumbnail file which has a suffix of ＂ithmb＂ saves the important information of image, through the interpretation of the data structure, the image deleted thumbnails can be restored, so as to provide key evidence and clues for the investigation of lOS mobile devices. This paper analyses the use of ithmb file, and combining with BMP file format, describes how to restore the image data by using the ithmb file, then describes the development of the ithmb analysis software to realize the recovery of thumbnails.