Key Technologies of Phone Storage Forensics Based on ARM Architecture

Smart phones are mainly running Android, IOS and Windows Phone three mobile platform operating systems. The android smart phone has the best market shares and its processor chips are almost ARM software architecture. The chips memory address mapping mechanism of ARM software architecture is different with x86 software architecture. To forensics to android mart phone, we need to understand three key technologies: memory data acquisition, the conversion mechanism from virtual address to the physical address, and find the system's key data. This article presents a viable solution which does not rely on the operating system API for a complete solution to these three issues.