Volume 9 Number 10 (Oct. 2014)
Home > Archive > 2014 > Volume 9 Number 10 (Oct. 2014) >
JCP 2014 Vol.9(10): 2294-2302 ISSN: 1796-203X
doi: 10.4304/jcp.9.10.2294-2302

A Reconstructing Android User Behavior Approach Based on YAFFS2 and SQLite

Ming Xu, Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, and Shiyue Ling
College of Computer, Hangzhou Dianzi University, Hangzhou, China

Abstract—Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, Shiyue Ling College of Computer, Hangzhou Dianzi University, Hangzhou, China

Index Terms—Nowadays, a variety of Android user behavior information is automatically stored in SQLite to indicate when and what user behavior took places. In this paper, an approach to reconstruct Android user behavior from YAFFS2 based on SQLite is proposed. Based on the storage mechanism of YAFFS2 file system and the file structures of SQLite, all of the SQLite records can be recovered from the Android image, regardless of whether the SQLite file has been deleted or not in YAFFS2, and the user behaviors are parsed from those recovered SQLite records; then an Android user behavior timeline is constructed for visualizing based on the time stamp stored in it’s SQLite records. The evaluated experiment results show that the proposed method can reconstruct user behavior correctly, and can obtain more user behaviors than Encase to help investigators to complete digital forensic.

[PDF]

Cite: Ming Xu, Jun Yao, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, and Shiyue Ling, "A Reconstructing Android User Behavior Approach Based on YAFFS2 and SQLite," Journal of Computers vol. 9, no. 10, pp. 2294-2302, 2014.

General Information

ISSN: 1796-203X
Abbreviated Title: J.Comput.
Frequency: Monthly
Editor-in-Chief: Prof. Liansheng Tan
Executive Editor: Ms. Nina Lee
Abstracting/ Indexing: DBLP, EBSCO,  ProQuest, INSPEC, ULRICH's Periodicals Directory, WorldCat, CNKI,etc
E-mail: jcp@iap.org
  • Jul 19, 2019 News!

    Vol 14, No 7 has been published with online version   [Click]

  • Jun 21, 2019 News!

    Vol 14, No 6 has been published with online version   [Click]

  • Apr 28, 2019 News!

    Vol 14, No 5 has been published with online version 7 papers are published in this issue after peer review   [Click]

  • Mar 20, 2019 News!

    Vol 14, No 3 has been published with online version   [Click]

  • Feb 22, 2019 News!

    Vol 14, No 2 has been published with online version 8 papers are published in this issue after peer review   [Click]

  • Read more>>