mobile-forensics

移动设备取证

全面的移动设备取证技能，用于分析 iOS 和 Android 设备数据。支持从移动设备备份和提取数据中提取并分析通信记录、应用数据、位置历史、媒体文件和系统痕迹。

功能

• iOS 分析：解析 iTunes/Finder 备份、文件系统映像
• Android 分析：解析 ADB 备份、文件系统提取数据
• 通信分析：提取 SMS、MMS、通话记录和即时通信应用数据
• 应用数据分析：解析应用数据库和缓存
• 位置分析：提取 GPS 数据、位置历史和地理围栏
• 媒体分析：整理照片和视频目录并分析元数据
• 联系人分析：从所有来源提取联系人
• 浏览器历史记录：分析移动浏览器痕迹
• 云数据：分析同步的云服务数据
• 时间线生成：创建设备活动时间线

快速开始

from mobile_forensics import MobileAnalyzer, iOSParser, AndroidParser

# Analyze iOS backup
ios = iOSParser("/evidence/ios_backup/")
messages = ios.get_messages()
calls = ios.get_call_history()

# Analyze Android extraction
android = AndroidParser("/evidence/android_extraction/")
contacts = android.get_contacts()

用法

任务 1：iOS 备份分析

输入：iTunes/Finder 备份目录

流程：

1. 加载并解密备份（如已加密）
2. 解析 Manifest 数据库
3. 提取并分析数据
4. 解析应用数据
5. 生成设备报告

输出：全面的 iOS 备份分析

示例：

from mobile_forensics import iOSParser

# Initialize parser
parser = iOSParser("/evidence/ios_backup/")

# Get backup info
info = parser.get_backup_info()
print(f"Device: {info.device_name}")
print(f"iOS Version: {info.ios_version}")
print(f"Serial: {info.serial_number}")
print(f"IMEI: {info.imei}")
print(f"Backup Date: {info.backup_date}")
print(f"Encrypted: {info.is_encrypted}")

# Decrypt if needed
if info.is_encrypted:
    parser.decrypt(password="backup_password")

# Get messages (SMS/iMessage)
messages = parser.get_messages()
for msg in messages:
    print(f"[{msg.date}] {msg.sender} -> {msg.recipient}")
    print(f"  Text: {msg.text}")
    print(f"  Type: {msg.message_type}")
    print(f"  Delivered: {msg.is_delivered}")
    print(f"  Read: {msg.is_read}")

# Get call history
calls = parser.get_call_history()
for call in calls:
    print(f"[{call.date}] {call.call_type}: {call.phone_number}")
    print(f"  Duration: {call.duration}s")
    print(f"  Location: {call.location}")

# Get contacts
contacts = parser.get_contacts()
for contact in contacts:
    print(f"Contact: {contact.name}")
    print(f"  Phone: {contact.phone_numbers}")
    print(f"  Email: {contact.emails}")

# Get Safari history
safari = parser.get_safari_history()
for entry in safari:
    print(f"[{entry.visit_date}] {entry.title}")
    print(f"  URL: {entry.url}")

# Get photos
photos = parser.get_photos()
for photo in photos:
    print(f"Photo: {photo.filename}")
    print(f"  Date: {photo.date_taken}")
    print(f"  Location: {photo.gps_location}")
    print(f"  Camera: {photo.camera_info}")

# Get location history
locations = parser.get_location_history()
for loc in locations:
    print(f"[{loc.timestamp}] {loc.latitude}, {loc.longitude}")
    print(f"  Accuracy: {loc.accuracy}m")
    print(f"  Source: {loc.source}")

# Export all data
parser.export_all("/evidence/ios_export/")
parser.generate_report("/evidence/ios_report.html")

任务 2：Android 分析

输入：Android 备份或提取数据

流程：

1. 加载 Android 数据
2. 解析数据库
3. 提取通信记录
4. 分析应用
5. 生成报告

输出：Android 设备分析

示例：

from mobile_forensics import AndroidParser

# Initialize parser
parser = AndroidParser("/evidence/android_extraction/")

# Get device info
info = parser.get_device_info()
print(f"Device: {info.manufacturer} {info.model}")
print(f"Android: {info.android_version}")
print(f"Build: {info.build_number}")
print(f"Serial: {info.serial_number}")
print(f"IMEI: {info.imei}")

# Get SMS messages
sms = parser.get_sms()
for msg in sms:
    print(f"[{msg.date}] {msg.direction}: {msg.address}")
    print(f"  Body: {msg.body}")
    print(f"  Read: {msg.read}")

# Get call logs
calls = parser.get_call_logs()
for call in calls:
    print(f"[{call.date}] {call.type}: {call.number}")
    print(f"  Duration: {call.duration}s")
    print(f"  Name: {call.cached_name}")

# Get contacts
contacts = parser.get_contacts()
for contact in contacts:
    print(f"Contact: {contact.display_name}")
    print(f"  Numbers: {contact.phone_numbers}")
    print(f"  Account: {contact.account_type}")

# Get Chrome history
chrome = parser.get_chrome_history()
for entry in chrome:
    print(f"[{entry.visit_time}] {entry.title}")
    print(f"  URL: {entry.url}")

# Get WiFi networks
wifi = parser.get_wifi_networks()
for network in wifi:
    print(f"SSID: {network.ssid}")
    print(f"  Security: {network.security}")
    print(f"  First connected: {network.first_connected}")

# Get installed apps
apps = parser.get_installed_apps()
for app in apps:
    print(f"App: {app.name}")
    print(f"  Package: {app.package_name}")
    print(f"  Version: {app.version}")
    print(f"  Installed: {app.install_date}")

# Get location data
locations = parser.get_locations()

# Export and report
parser.export_all("/evidence/android_export/")
parser.generate_report("/evidence/android_report.html")

任务 3：即时通信应用分析

输入：移动设备数据

流程：

1. 识别已安装的即时通信应用
2. 定位应用数据库
3. 解析消息内容
4. 提取媒体文件和附件
5. 构建对话时间线

输出：即时通信应用分析

示例：

from mobile_forensics import MessagingAnalyzer

# Initialize analyzer
analyzer = MessagingAnalyzer("/evidence/device_extraction/")

# Detect available messaging apps
apps = analyzer.detect_messaging_apps()
for app in apps:
    print(f"Found: {app.name}")
    print(f"  Data available: {app.has_data}")

# Parse WhatsApp
whatsapp = analyzer.parse_whatsapp()
print(f"WhatsApp messages: {len(whatsapp.messages)}")
print(f"WhatsApp contacts: {len(whatsapp.contacts)}")
print(f"WhatsApp groups: {len(whatsapp.groups)}")

for chat in whatsapp.chats:
    print(f"Chat with: {chat.contact_name}")
    print(f"  Messages: {chat.message_count}")
    print(f"  Last message: {chat.last_message_date}")

    for msg in chat.messages[-5:]:  # Last 5 messages
        print(f"    [{msg.timestamp}] {msg.sender}: {msg.content}")

# Parse Telegram
telegram = analyzer.parse_telegram()
for chat in telegram.chats:
    print(f"Telegram: {chat.title}")
    print(f"  Type: {chat.chat_type}")
    print(f"  Messages: {chat.message_count}")

# Parse Signal
signal = analyzer.parse_signal()
for conversation in signal.conversations:
    print(f"Signal: {conversation.recipient}")
    print(f"  Messages: {conversation.message_count}")

# Parse Facebook Messenger
messenger = analyzer.parse_messenger()

# Parse Instagram DMs
instagram = analyzer.parse_instagram()

# Export media
analyzer.export_media("/evidence/messaging_media/")

# Generate unified timeline
timeline = analyzer.create_timeline()
for event in timeline:
    print(f"[{event.timestamp}] {event.app}: {event.summary}")

# Generate report
analyzer.generate_report("/evidence/messaging_report.html")

任务 4：位置分析

输入：移动设备数据

流程：

1. 从照片中提取 GPS 数据
2. 解析位置数据库
3. 分析位置历史
4. 识别重要地点
5. 创建位置时间线

输出：带地图的位置分析

示例：

from mobile_forensics import LocationAnalyzer

# Initialize analyzer
analyzer = LocationAnalyzer("/evidence/device_extraction/")

# Get all location data
locations = analyzer.get_all_locations()
print(f"Total location points: {len(locations)}")

for loc in locations[:10]:
    print(f"[{loc.timestamp}] {loc.latitude}, {loc.longitude}")
    print(f"  Source: {loc.source}")  # GPS, WiFi, Cell, Photo
    print(f"  Accuracy: {loc.accuracy}m")
    print(f"  Address: {loc.reverse_geocode}")

# Get significant locations (iOS)
significant = analyzer.get_significant_locations()
for loc in significant:
    print(f"Significant: {loc.label}")
    print(f"  Visits: {loc.visit_count}")
    print(f"  Average duration: {loc.avg_duration}")

# Get location history from Google
google_history = analyzer.get_google_location_history()

# Get photo locations
photo_locations = analyzer.get_photo_locations()
for photo in photo_locations:
    print(f"Photo: {photo.filename}")
    print(f"  Location: {photo.latitude}, {photo.longitude}")
    print(f"  Time: {photo.timestamp}")

# Find locations at specific time
time_locations = analyzer.get_locations_at_time(
    start="2024-01-15 09:00",
    end="2024-01-15 18:00"
)

# Find visits to location
visits = analyzer.find_visits_to_location(
    latitude=40.7128,
    longitude=-74.0060,
    radius_meters=100
)

# Create KML export
analyzer.export_kml("/evidence/locations.kml")

# Create timeline map
analyzer.create_map("/evidence/location_map.html")

# Generate location report
analyzer.generate_report("/evidence/location_report.html")

任务 5：应用数据分析

输入：移动设备提取数据

流程：

1. 清点已安装的应用
2. 定位应用数据目录
3. 解析应用数据库
4. 提取缓存数据
5. 分析用户活动

输出：应用分析报告

示例：

from mobile_forensics import AppAnalyzer

# Initialize analyzer
analyzer = AppAnalyzer("/evidence/device_extraction/")

# Get installed apps
apps = analyzer.get_installed_apps()

for app in apps:
    print(f"App: {app.name}")
    print(f"  Package: {app.package_name}")
    print(f"  Version: {app.version}")
    print(f"  Install date: {app.install_date}")
    print(f"  Last used: {app.last_used}")
    print(f"  Data size: {app.data_size_mb}MB")

# Analyze specific app
app_data = analyzer.analyze_app("com.example.app")
print(f"Databases: {app_data.databases}")
print(f"Shared prefs: {app_data.shared_preferences}")
print(f"Cache files: {app_data.cache_files}")

# Parse SQLite databases in app
for db in app_data.databases:
    tables = analyzer.get_db_tables(db)
    print(f"Database: {db.name}")
    for table in tables:
        print(f"  Table: {table.name} ({table.row_count} rows)")

# Get app permissions
permissions = analyzer.get_app_permissions("com.example.app")
for perm in permissions:
    print(f"Permission: {perm.name}")
    print(f"  Granted: {perm.granted}")
    print(f"  Dangerous: {perm.is_dangerous}")

# Find apps with sensitive permissions
sensitive_apps = analyzer.find_apps_with_permissions([
    "READ_CONTACTS",
    "READ_SMS",
    "ACCESS_FINE_LOCATION",
    "CAMERA"
])

# Export app data
analyzer.export_app_data("com.example.app", "/evidence/app_export/")

# Generate app inventory report
analyzer.generate_report("/evidence/app_report.html")

任务 6：通信时间线

输入：移动设备数据

流程：

1. 提取所有类型的通信记录
2. 解析时间戳
3. 构建统一时间线
4. 识别模式
5. 检测异常

输出：统一通信时间线

示例：

from mobile_forensics import CommunicationsTimeline

# Initialize timeline
timeline = CommunicationsTimeline("/evidence/device_extraction/")

# Add all sources
timeline.add_sms()
timeline.add_calls()
timeline.add_imessage()
timeline.add_whatsapp()
timeline.add_telegram()
timeline.add_messenger()
timeline.add_email()

# Build unified timeline
events = timeline.build()

for event in events:
    print(f"[{event.timestamp}] {event.type} - {event.app}")
    print(f"  From: {event.sender}")
    print(f"  To: {event.recipient}")
    print(f"  Summary: {event.summary}")

# Filter by contact
contact_timeline = timeline.filter_by_contact("+1234567890")
print(f"Communications with contact: {len(contact_timeline)}")

# Filter by date range
date_timeline = timeline.filter_by_date(
    start="2024-01-01",
    end="2024-01-31"
)

# Get communication patterns
patterns = timeline.analyze_patterns()
print(f"Most contacted: {patterns.top_contacts}")
print(f"Peak hours: {patterns.peak_hours}")
print(f"App usage: {patterns.app_distribution}")

# Detect anomalies
anomalies = timeline.detect_anomalies()
for a in anomalies:
    print(f"ANOMALY: {a.description}")
    print(f"  Time: {a.timestamp}")
    print(f"  Significance: {a.significance}")

# Export timeline
timeline.export_csv("/evidence/communications_timeline.csv")
timeline.generate_report("/evidence/communications_report.html")

任务 7：媒体分析

输入：移动设备中的照片和视频

流程：

1. 提取所有媒体文件
2. 解析 EXIF 元数据
3. 提取 GPS 坐标
4. 识别人脸/物体
5. 构建媒体时间线

输出：带元数据的媒体分析

示例：

from mobile_forensics import MediaAnalyzer

# Initialize analyzer
analyzer = MediaAnalyzer("/evidence/device_extraction/")

# Get all media
media = analyzer.get_all_media()
print(f"Total photos: {media.photo_count}")
print(f"Total videos: {media.video_count}")
print(f"Total size: {media.total_size_gb}GB")

# Analyze photos
photos = analyzer.get_photos()
for photo in photos:
    print(f"Photo: {photo.filename}")
    print(f"  Date taken: {photo.date_taken}")
    print(f"  Camera: {photo.camera_make} {photo.camera_model}")
    print(f"  Location: {photo.latitude}, {photo.longitude}")
    print(f"  Size: {photo.width}x{photo.height}")

# Analyze videos
videos = analyzer.get_videos()
for video in videos:
    print(f"Video: {video.filename}")
    print(f"  Duration: {video.duration}s")
    print(f"  Date: {video.date_created}")
    print(f"  Location: {video.latitude}, {video.longitude}")

# Get media with locations
geotagged = analyzer.get_geotagged_media()
print(f"Media with GPS: {len(geotagged)}")

# Find media in date range
dated = analyzer.find_by_date(
    start="2024-01-01",
    end="2024-01-31"
)

# Find media by location
location_media = analyzer.find_by_location(
    latitude=40.7128,
    longitude=-74.0060,
    radius_km=1
)

# Export with metadata
analyzer.export_media("/evidence/media_export/")
analyzer.export_metadata("/evidence/media_metadata.csv")

# Generate media report
analyzer.generate_report("/evidence/media_report.html")

任务 8：云数据分析

输入：移动设备云同步数据

流程：

1. 识别已同步的服务
2. 提取云令牌
3. 分析同步数据
4. 识别云账户
5. 记录云活动

输出：云服务分析

示例：

from mobile_forensics import CloudAnalyzer

# Initialize analyzer
analyzer = CloudAnalyzer("/evidence/device_extraction/")

# Detect cloud services
services = analyzer.detect_cloud_services()
for service in services:
    print(f"Cloud service: {service.name}")
    print(f"  Account: {service.account}")
    print(f"  Data available: {service.has_data}")

# Analyze iCloud data
icloud = analyzer.analyze_icloud()
print(f"iCloud account: {icloud.account_email}")
print(f"iCloud Drive files: {len(icloud.drive_files)}")
print(f"iCloud Photos: {icloud.photo_count}")
print(f"Synced contacts: {icloud.contact_count}")

# Analyze Google account data
google = analyzer.analyze_google()
print(f"Google account: {google.account_email}")
print(f"Drive files: {len(google.drive_files)}")
print(f"Photos: {google.photo_count}")

# Get cloud tokens (for authorized access)
tokens = analyzer.extract_cloud_tokens()
for token in tokens:
    print(f"Token for: {token.service}")
    print(f"  Type: {token.token_type}")
    print(f"  Expires: {token.expiry}")

# Analyze cloud backup data
backups = analyzer.get_cloud_backups()
for backup in backups:
    print(f"Backup: {backup.service}")
    print(f"  Date: {backup.backup_date}")
    print(f"  Size: {backup.size_mb}MB")

# Generate cloud report
analyzer.generate_report("/evidence/cloud_report.html")

任务 9：已删除数据恢复

输入：移动设备文件系统

流程：

1. 分析空闲空间
2. 恢复已删除文件
3. 解析已删除的数据库记录
4. 重建已删除的消息
5. 记录恢复结果

输出：已恢复的删除数据

示例：

from mobile_forensics import DeletedDataRecovery

# Initialize recovery
recovery = DeletedDataRecovery("/evidence/device_extraction/")

# Recover deleted SQLite records
messages = recovery.recover_deleted_messages()
for msg in messages:
    print(f"RECOVERED: [{msg.date}] {msg.sender}")
    print(f"  Content: {msg.content}")
    print(f"  Recovery confidence: {msg.confidence}")

# Recover deleted photos
photos = recovery.recover_deleted_photos(
    output_dir="/evidence/recovered_photos/"
)
for photo in photos:
    print(f"Recovered: {photo.filename}")
    print(f"  Original path: {photo.original_path}")
    print(f"  Confidence: {photo.confidence}")

# Recover deleted contacts
contacts = recovery.recover_deleted_contacts()

# Recover deleted call logs
calls = recovery.recover_deleted_calls()

# Recover from WhatsApp
whatsapp = recovery.recover_deleted_whatsapp()

# Analyze SQLite WAL files
wal_data = recovery.analyze_wal_files()
for entry in wal_data:
    print(f"WAL recovery: {entry.table}")
    print(f"  Records: {entry.record_count}")

# Generate recovery report
recovery.generate_report("/evidence/recovery_report.html")

任务 10：移动恶意软件分析

输入：移动设备数据

流程：

1. 扫描已知恶意软件
2. 识别可疑应用
3. 分析权限滥用
4. 检查 rootkit 指标
5. 生成威胁报告

输出：移动威胁分析

示例：

from mobile_forensics import MobileThreatAnalyzer

# Initialize analyzer
analyzer = MobileThreatAnalyzer("/evidence/device_extraction/")

# Scan for known malware
malware = analyzer.scan_for_malware()
for m in malware:
    print(f"MALWARE: {m.app_name}")
    print(f"  Package: {m.package_name}")
    print(f"  Family: {m.malware_family}")
    print(f"  Confidence: {m.confidence}")

# Check for suspicious apps
suspicious = analyzer.find_suspicious_apps()
for app in suspicious:
    print(f"SUSPICIOUS: {app.name}")
    print(f"  Reason: {app.reason}")
    print(f"  Permissions: {app.suspicious_permissions}")

# Check for root/jailbreak
root_status = analyzer.check_root_status()
print(f"Device rooted: {root_status.is_rooted}")
print(f"Indicators: {root_status.indicators}")

# Check for spyware indicators
spyware = analyzer.detect_spyware()
for s in spyware:
    print(f"SPYWARE INDICATOR: {s.indicator}")
    print(f"  Details: {s.details}")

# Analyze app network behavior
network = analyzer.analyze_app_network()
for app in network:
    print(f"App: {app.name}")
    print(f"  Domains contacted: {app.domains}")
    print(f"  Suspicious: {app.suspicious_connections}")

# Generate threat report
analyzer.generate_report("/evidence/threat_report.html")

配置

环境变量

变量	描述	必需	默认值
ADB_PATH	ADB 二进制文件的路径	否	系统 PATH
BACKUP_PASSWORD	iOS 备份密码	否	无
MAPS_API_KEY	用于生成地图的 API 密钥	否	无
MALWARE_HASHES	恶意软件哈希数据库的路径	否	无

选项

选项	类型	描述
decrypt_backup	boolean	尝试解密备份
recover_deleted	boolean	尝试恢复已删除的数据
extract_media	boolean	提取媒体文件
geocode_locations	boolean	对坐标进行反向地理编码
parallel	boolean	启用并行处理

示例

示例 1：刑事调查

场景：分析嫌疑人的手机以寻找证据

from mobile_forensics import MobileAnalyzer

# Load device extraction
analyzer = MobileAnalyzer("/evidence/suspect_phone/")

# Get all communications
timeline = analyzer.get_communications_timeline()

# Filter for relevant time period
incident_comms = timeline.filter_by_date(
    start="2024-01-14",
    end="2024-01-16"
)

# Get location during incident
locations = analyzer.get_locations_at_time(
    start="2024-01-15 22:00",
    end="2024-01-16 02:00"
)

# Find communications with specific number
suspect_contact = timeline.filter_by_contact("+1234567890")

# Export evidence
analyzer.export_evidence("/evidence/case_evidence/")

示例 2：企业调查

场景：调查通过移动设备实施的数据盗窃

from mobile_forensics import MobileAnalyzer, CloudAnalyzer

# Analyze company phone
analyzer = MobileAnalyzer("/evidence/employee_phone/")

# Check for unauthorized cloud services
cloud = CloudAnalyzer("/evidence/employee_phone/")
services = cloud.detect_cloud_services()

# Find file sharing activity
file_activity = analyzer.search_for_files(
    extensions=[".pdf", ".xlsx", ".docx"]
)

# Check messaging for data sharing
messaging = analyzer.get_messaging_data()
attachments = messaging.find_attachments()

限制

• 加密设备需要密码／凭据
• 某些应用数据可能已由应用加密
• 访问云端数据需要适当的授权
• 已删除数据的恢复成功率不一
• 某些功能需要进行物理提取
• 对特定应用的解析支持可能有限
• 位置数据取决于用户设置

故障排除

常见问题 1：加密备份

问题：无法读取加密的 iOS 备份 解决方案：

• 提供备份密码
• 使用备份密码恢复工具
• 向设备所有者索要密码

常见问题 2：ADB 连接问题

问题：无法连接到 Android 设备 解决方案：

• 启用 USB 调试
• 接受 RSA 指纹
• 尝试更换 USB 线缆或端口

常见问题 3：缺少应用数据

问题：未找到预期的应用数据 解决方案：

• 应用可能仅使用云端存储
• 数据可能已由应用加密
• 检查应用专用的备份位置

相关技能

• memory-forensics：设备内存分析
• disk-forensics：设备存储分析
• network-forensics：移动流量分析
• cloud-forensics：云同步数据分析
• timeline-forensics：时间线整合

参考资料

• 移动设备取证参考
• iOS 取证痕迹指南
• Android 取证痕迹指南