不同取证系统对手机微信聊天记录恢复效果的比较分析

Comparative Study on the Effect of Different Forensics Systems in Recovering Deleted Chat Records of Mobile Phone WeChat

在对新型涉网犯罪的打击过程中,犯罪嫌疑人手机数据的采集是取证的关键环节,而在实战中,手机中存在至关重要线索和证据的微信聊天记录通常会被删除。如何能够快速、高效地恢复犯罪嫌疑人手机中已删除的微信聊天记录,是相关案件侦查过程中面临的亟待解决的问题。本文采用了目前最普遍使用的四款取证系统的最新版本,分别对当下主流的三十余款型号的华为和苹果手机进行微信数据采集,并在第一次采集完成后,对旧系统版本的实验手机进行系统升级后再次采集数据,以此比对分析不同取证系统恢复华为、苹果手机已删除微信聊天记录的效果。本文能为相关案件侦办中取证工具的选择提供参考。

In the process of cracking down on new types of network-related crimes,the collection of data from suspects’mobile phones is a key part in obtaining evidence,while in actual cases,the WeChat records in the mobile phone,which have vital clues and evidence,are usually deleted.How to quickly and effi ciently restore the deleted WeChat records in the suspects’mobile phones is an urgent problem to be solved in the investigation of related cases.This paper used the latest version of the four most commonly used forensics systems to collect WeChat data twice from more than thirty models of mainstream Huawei and Apple cell phones.The data was collected directly without any operation on the mobile phone,and then the data was collected again after the old version of the operating system was upgraded.In this way,we could compare and analyze the effect of different forensic systems to restore the deleted chat records of Huawei and Apple mobile phones.This paper can provide a reference for the selection of forensic tools in the investigation of related cases.