摘要：Nowadays, a variety of Android user behavior information is automatically stored in SQLite to indicate when and what user behavior took places. In this paper, an approach to reconstruct Android user behavior from YAFFS2 based on SQLite is proposed. Based on the storage mechanism of YAFFS2 file system and the file structures of SQLite, all of the SQLite records can be recovered from the Android image, regardless of whether the SQLite file has been deleted or not in YAFFS2, and the user behaviors are parsed from those recovered SQLite records; then an Android user behavior timeline is constructed for visualizing based on the time stamp stored in it’s SQLite records. The evaluated experiment results show that the proposed method can reconstruct user behavior correctly, and can obtain more user behaviors than Encase to help investigators to complete digital forensic.
