A Recovery Approach for SQLite History Recorders from YAFFS2 - Inria - Institut national de recherche en sciences et technologies du numérique
Communication Dans Un Congrès Année : 2013

A Recovery Approach for SQLite History Recorders from YAFFS2

Ming Xu
  • Fonction : Auteur
  • PersonId : 1003077
Haiping Zhang
  • Fonction : Auteur
  • PersonId : 1003078
Jian Xu

Résumé

Nowadays, forensic on flash memories has drawn much attention. In this paper, a recovery method for SQLite database history records (I.e. updated and deleted records) form YAFFS2 is proposed. Based on the out-of-place-write strategies in NAND flash memory required by YAFFS2, the SQLite history recorders can be recovered and ordered into timeline by their timestamps. The experiment results show that the proposed method can recover the updated or deleted records correctly. Our method can help investigators to find the significant information about user actions in Android smart phones by these history recorders, although they seem to have been disappeared or deleted.
Fichier principal
Vignette du fichier
978-3-642-36818-9_30_Chapter.pdf (335.81 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01480183 , version 1 (01-03-2017)

Licence

Identifiants

Citer

Beibei Wu, Ming Xu, Haiping Zhang, Jian Xu, Yizhi Ren, et al.. A Recovery Approach for SQLite History Recorders from YAFFS2. 1st International Conference on Information and Communication Technology (ICT-EurAsia), Mar 2013, Yogyakarta, Indonesia. pp.295-299, ⟨10.1007/978-3-642-36818-9_30⟩. ⟨hal-01480183⟩
136 Consultations
406 Téléchargements

Altmetric

Partager

More