A flexibility method of QQ forensic in Android system

As one of the most popular instant messaging applications on smart devices, mobile QQ contains kinds of user data which even includes the evidence information of important investigation, so forensic analysis for mobile QQ is significant. Aiming at this situation, at first, this paper introduced the basic information about Android system and mobile QQ, and the research status of forensic model and forensic analysis of instant messaging application. Then, referring to traditional digital forensic models and features of Android smart device and mobile QQ, this paper came up with a forensic model and a flexibility method for mobile QQ. Forensic model is to standardize the process of mobile QQ forensic analysis. Flexibility method is to solve the problem of different versions of mobile QQ in the process of forensic analysis. After that, this paper evaluated and compared the proposed forensic analysis method with typical commercial digital forensic analysis software by ability of data collection, ability of data credible evaluation and machine readable ability of forensic result. The result shows that the flexibility method has a couple of advantages in QQ forensic analysis.