手机取证软件框架的设计与实现

发布时间：2017-12-31 03:01

本文关键词：手机取证软件框架的设计与实现　出处：《大连海事大学》2012年硕士论文　论文类型：学位论文

【摘要】：随着手机、PDA等各种移动电子设备的广泛使用,利用手机进行的各类犯罪活动日益猖獗。手机取证技术的相关研究对于打击与手机相关的各类犯罪活动、维护社会稳定具有重要意义。手机取证不同于一般的计算机取证,这是由于：一是手机操作系统种类多、接口不统一、驱动及连接方式不同等多种差异性的存在；二是通信网络又在不断的改进变化之中。上述原因决定了手机取证技术一定是多样化的,并且需要不断的发展,以保证跟上手机和通信网络技术进步的步伐。因此对手机取证技术研究具有重要的现实意义。本文分析研究了当前手机取证技术的现状和发展趋势,从三层架构的角度使用UML工具重点剖析了TULP2G取证软件的结构并深入分析其设计思想,在此基础上使用基于软件开发的原则和模式对其设计存在的缺陷提出系统框架改进方案,通过改进前后的灵活性和性能对比,论述改进方案的优越性。本论文利用改进后的TULP2G取证软件获取取证数据,提取出的数据具有如下特点：数据量较大；存在很多无关信息；看不出数据之间的相关性。为了便于取证人员对取证数据进行相关性分析,本文使用基于向量时钟的数据相关性模型,在此模型基础上设计出可视化相关性工具,使得由TULP2G软件提取出的数据经过该可视化工具处理后更加形象、直观,便于取证人员获取有用信息。
[Abstract]:With the widespread use of various mobile electronic devices such as mobile phones and PDAs , various kinds of criminal activities using mobile phones are increasingly rampant . The relevant research of mobile phone access technology is of great significance to combat all kinds of criminal activities related to mobile phones and to maintain social stability . Mobile phone evidence is different from general computer forensics , which is due to many different kinds of different kinds of mobile phone operating systems , different interfaces , different driving and connection modes , and the continuous improvement of communication network . The above reasons determine that mobile phone forensics technology must be diversified and need to be continuously developed to keep up with the progress of mobile phone and communication network technology . Therefore , it has important practical significance to study the technology of mobile phone forensics . This paper analyzes the present situation and developing trend of the current mobile phone forensics technology , analyzes the structure of the TULP2G certification software from the perspective of the three - tier architecture and deeply analyzes its design thought . On the basis of this , the defects of the design of TULP2G based on the principles and modes of software development are used to improve the system framework improvement scheme , and the advantages of the improved scheme are discussed through the improvement of the flexibility and the performance comparison before and after the improvement . This paper takes advantage of the improved TULP2G forensic software to obtain the forensic data . The extracted data has the following characteristics : large amount of data , many irrelevant information , and no correlation between the data . In order to facilitate the correlation analysis between the evidence data and the evidence data , a visual correlation tool is designed on the basis of this model , so that the data extracted by the TULP2G software is more vivid and visual after being processed by the visualization tool , so that useful information can be obtained conveniently .

【学位授予单位】：大连海事大学
【学位级别】：硕士
【学位授予年份】：2012
【分类号】：TN929.53;D918.2

【参考文献】