JCP 2014 Vol.9(10): 2294-2302 ISSN: 1796-203X
doi: 10.4304/jcp.9.10.2294-2302
doi: 10.4304/jcp.9.10.2294-2302
A Reconstructing Android User Behavior Approach Based on YAFFS2 and SQLite
Ming Xu, Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, and Shiyue Ling
College of Computer, Hangzhou Dianzi University, Hangzhou, China
Abstract—Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, Shiyue Ling College of Computer, Hangzhou Dianzi University, Hangzhou, China
Index Terms—Nowadays, a variety of Android user behavior information is automatically stored in SQLite to indicate when and what user behavior took places. In this paper, an approach to reconstruct Android user behavior from YAFFS2 based on SQLite is proposed. Based on the storage mechanism of YAFFS2 file system and the file structures of SQLite, all of the SQLite records can be recovered from the Android image, regardless of whether the SQLite file has been deleted or not in YAFFS2, and the user behaviors are parsed from those recovered SQLite records; then an Android user behavior timeline is constructed for visualizing based on the time stamp stored in it’s SQLite records. The evaluated experiment results show that the proposed method can reconstruct user behavior correctly, and can obtain more user behaviors than Encase to help investigators to complete digital forensic.
Abstract—Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, Shiyue Ling College of Computer, Hangzhou Dianzi University, Hangzhou, China
Index Terms—Nowadays, a variety of Android user behavior information is automatically stored in SQLite to indicate when and what user behavior took places. In this paper, an approach to reconstruct Android user behavior from YAFFS2 based on SQLite is proposed. Based on the storage mechanism of YAFFS2 file system and the file structures of SQLite, all of the SQLite records can be recovered from the Android image, regardless of whether the SQLite file has been deleted or not in YAFFS2, and the user behaviors are parsed from those recovered SQLite records; then an Android user behavior timeline is constructed for visualizing based on the time stamp stored in it’s SQLite records. The evaluated experiment results show that the proposed method can reconstruct user behavior correctly, and can obtain more user behaviors than Encase to help investigators to complete digital forensic.
Cite: Ming Xu, Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, and Shiyue Ling, "A Reconstructing Android User Behavior Approach Based on YAFFS2 and SQLite," Journal of Computers vol. 9, no. 10, pp. 2294-2302, 2014.
General Information
ISSN: 1796-203X
Abbreviated Title: J.Comput.
Frequency: Bimonthly
Abbreviated Title: J.Comput.
Frequency: Bimonthly
Editor-in-Chief: Prof. Liansheng Tan
Executive Editor: Ms. Nina Lee
Abstracting/ Indexing: DBLP, EBSCO, ProQuest, INSPEC, ULRICH's Periodicals Directory, WorldCat,etc
E-mail: jcp@iap.org
-
Nov 14, 2019 News!
Vol 14, No 11 has been published with online version [Click]
-
Mar 20, 2020 News!
Vol 15, No 2 has been published with online version [Click]
-
Dec 16, 2019 News!
Vol 14, No 12 has been published with online version [Click]
-
Sep 16, 2019 News!
Vol 14, No 9 has been published with online version [Click]
-
Aug 16, 2019 News!
Vol 14, No 8 has been published with online version [Click]
- Read more>>