Database management strategy and recovery methods of Android

Database analysis and the recovery of deleted record are two of the most important parts in digital forensics. This paper focuses on the management mechanism of Android S MS database, involving the analyses of write-in rules of database and log files during the data updating process. Based on the research results, a recovery method for database operating records from WAL file is proposed. To solve the problem that the log file is emptied, this paper presents a recovery method for the deleted log file for ext4 file system, thus constructing a database operating record timeline. Finally, an experiment based on images generated in different time and conditions is carried out to validate the effectiveness of the proposed method, discussion on its limitations is conducted.