安卓模拟器应用取证

Applicative Forensics for Android Simulator

安卓模拟器是能在电脑上模拟安卓操作系统,并能安装、使用、卸载安卓应用的工具类软件,它使用户在电脑上也能体验操作安卓系统的全过程。安卓模拟器由于操作简单、成本低,被一些不法分子用来进行违法犯罪活动。对于安卓模拟器内微信、QQ等应用的电子数据,利用现有的计算机和手机取证软件不能够直接提取解析,在检验鉴定过程中如果技术人员对犯罪技术手法不了解,对主流安卓模拟器应用程序不熟悉,就会造成安卓模拟器运行的应用数据漏提。本文尝试将计算机取证和手机取证相结合,多款软件多个流程协同完成安卓模拟器的应用取证。该方法可为电子取证技术人员提取安卓模拟器应用数据提供借鉴。

Android simulator is one tool software that can imitate Android operation system with computer to run, set up, utilize and uninstall Android applications so that users are able to experience by computer the whole operating course of Android system. Because of simple manipulation and low cost, Android simulator is often chosen with criminals to carry out illegal activities. Yet, the present computer-/mobile phone-applicable forensic competence is not eligible to directly extract and analyze the electronic data of WeChat, QQ and other applications kept in Android simulator. If the forensic electronic examiners do not understand the criminal artifices or are not familiar with the main applications run through Android simulator, they are very likely leaving out the applying data from Android simulator. This paper attempts to combine the forensics of both computer and mobile phone, collaborating with varieties of software and processes to achieve the applicative Android simulator forensics. Valuable reference should be here offered for peers to tackle similar cases.