Design and Implementation of Live SD Acquisition Tool in Android Smart Phone

From the end of 2007, the open-source characteristic of Android platform has been the most competitive one in the smart phone market. According to recent statistics from Gartner, Android's market share in February 2010 is 3.9%, rises to 17.2% in August in the same year, and reaches 22.7% in February 2011, which only falls behind Nokia's by 14.9%. From its skyrocketing growth rate, it can be expected that Google's Android operating system would become the dominate mobile platform. However, high market share comes with problems. For instance, in March 2011, Lookout, an information security company shows Dorid Dream will make the Android phones become the media of Bot Network. The ever-changing criminal conduct continuously challenges how well the present digital forensics could react. Data acquisition is an important part in mobile phone forensics. As the mobile forensic software becomes more mature and popular, most of them are now facing the same problem where the internal collecting tools must be installed in the mobile phones first so the data collecting could be started in turn. Whether this process is against the concept of protecting the original crime scene in forensics is questionable. A new concept called Live SD is therefore introduced in this work. It utilizes the concept of data recovery to perform physical data acquisition in Android smart phones. This data-acquisition methodology differs from the current ones in most mobile forensics software and can effectively perform the recovery of the deleted data.