An Anti-Forensics Method against Memory Acquiring for Android Devices

摘要

Mobile device forensics is an interdisciplinary field consisting of techniques applied to a wide range of computing devices. Android devices are among the most disruptive technologies of the last years, gaining even more diffusion and success in the daily life of a wide range of people categories. Android devices became even more important in the forensic field due to the rich amount of personal information they store. However, the forensics tools are often used to acquire privacy information by attackers. This papar presents an anti-forensics approach for Android devices which protects AES keys from being acquired by forensics tools. The keys are stored in the special memory space where the data will be covered when android reboots, thus attackers can not steal the privacy information.