Use EnCase to acquire data from a smartphone

最新推荐文章于 2025-09-11 20:53:34 发布

weixin_30610755

最新推荐文章于 2025-09-11 20:53:34 发布

阅读量78

点赞数

CC 4.0 BY-SA版权

文章标签：数据库

原文链接：http://www.cnblogs.com/pieces0310/p/5074469.html

本文演示如何使用EnCase软件从智能手机获取数据，包括安装驱动以正确识别设备，进行物理收购并生成E01图像以供进一步分析。通过查看证据文件找到NaverLINE数据库的位置，并使用外部SQLite查看器打开，展示聊天消息存储方式。

Yesterday someone asked me a question can EnCase acquire data from a smartphone, and my reply was "yes". Let me show you how to use Use EnCase to acquire data from a smartphone. Of course we have to install driver on the workstation first so that we could identify that smartphone correctly. If the smartphone is rooted, we could do the physical acquisition and generate E01 images for further analysis.

Let's take a look in the evidence file and find out where Naver LINE database is. The database name is "naver_line" and we could open this file by using external viewer-DB Browser for SQLite. Now we could see those chat messages in talbe "chat_history".