臺灣博碩士論文加值系統

智慧型手機就有如小型電腦一般，具備行動上網與通話等等基本功能，且能安裝各類應用程式，在日常生活中扮演提供即時資訊來源、資訊分享與資訊交流的重要角色。其中，Apple公司所出產的iPhone即為最熱門的智慧型手機之一。然而，隨著科技的進步，使用者的科技水平提升，相對的也使犯罪者的手法隨之進化。當犯罪者使用智慧型手機做為平臺，透過高科技平臺的輔助進行犯意溝通的連繫或直接使用智慧型手機做為犯罪的工具時，如何從中發掘有效且關鍵的數位證據，協助數位鑑識調查與證據取證，將會是一大挑戰。
本論文將以時下最為流行的智慧型手機iPhone作為研究標的，探討當iPhone手機被犯罪者做為犯意聯繫之溝通平台或犯罪工具時，如何有效的進行數位鑑識之調查工作。我們將深入研究當iPhone手機遭到犯罪者毀損時，如何透過Apple iTunes的備份檔案進行邏輯萃取，解析備份檔案內容，並且透過這項數位鑑識技術個化與解析手機應用程式所產生的相關數位證據。我們也將針對jailbreak程序是否對於儲存於iPhone內部的關鍵性數位證據造成異動的爭議進行相關研究，釐清事實。

謝誌 i
中文摘要 ii
目錄 iii
表目錄 v
圖目錄 vi

第一章、 緒論 1
1.1 前言 1
1.2 研究動機與目的 2
第二章、 文獻探討 5
2.1 iPhone數位鑑識 5
2.1.1 手動萃取 5
2.1.2 實體萃取 6
2.1.3 邏輯萃取 8
2.2 Apple iTunes與備份 8
2.3 iPhone手機應用程式 14
2.4 Jailbreak程序 17
第三章、 iPhone鑑識萃取分析研究 19
3.1 iPhone備份檔案解析方法探討 21
3.2 手機應用程式數位證據萃取與解析方法探討 26
3.2.1 環境設定 27
3.2.2 研究流程 28
3.2.3 萃取結果分析與討論 29
3.3 iPhone手機數位鑑識案例探討 33
第四章、 Jailbreak程序於數位證據之異動爭議研究 42
4.1 環境設定 43
4.2 異動觀察萃取流程 43
4.2.1 設定預設資料 44
4.2.2 Jailbreak前萃取 45
4.2.3 執行Jailbreak程序 45
4.2.4 Jailbreak後萃取 46
4.3 Jailbreak前後萃取結果分析 47
4.3.1 XRY萃取結果分析與呈現 47
4.3.2 Apple iTunes萃取結果分析與呈現 52
4.4 Jailbreak程序對iPhone數位證據之異動爭議討論 54
第五章、 結論與貢獻 56
參考文獻 58

[1]L. Alex, S. Bill and J. Daryl, “Third Party Application Forensics on Apple Mobile Devices”, Proceedings of the 44th Hawaii International Conference on System Sciences, IEEE, 2011.
[2]S. Azadegan, W. Yu, H. Liu, M. Sistani and S. Acharya, “Novel Anti-forensics Approaches for Smart Phones”, Proceedings of the 45th Hawaii International Conference on System Sciences, IEEE, 2012.
[3]M. Bader and I. Baggili, “iPhone 3GS Forensics: Logical Analysis Using Apple iTunes Backup Utility”, Small Scale Digital Device Forensics Journal, Volume 4, Number 1, September 2010.
[4]A. Di Stefano, A. Grillo, A. Lentini, G. Me and D. Tulimiero, “Mobile Forensics Data Integrity Assessment by Event Monitoring”, Digital Investigation, Volume 4 Number 1, September 2010.
[5]A. Hoog and K. Gaffaney, iPhone Forensics. Via Forensics, 2009.
[6]G. M. Luis and A. M. Joan, “Universal, Fast Method for iPad Forensic Imaging Via USB Adapter”, Fifth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, 2011.
[7]J. R. Rabaiotti and C. J. Hargreaves, “Using a software exploit to image RAM on an embedded system”, Digital Investigation, vol. 6, pp. 95-103, 2010.
[8]C. Yates, L. Ray and J. Yang, “An Investigation into iPod Touch Generation 2”, Information Security Curriculum Development Conference, 2011.
[9]J. Zdziarski, iPhone Forensics, O'Reilly Media, 2008.
[10]44 Billion Mobile App Downloads by 2016, Retrieved August 24, 2011, from http://www.abiresearch.com/press/3668-44+Billion+Mobile+App+Downloads+by+2016
[11]A. Crosby, “iPhone Forensics, without the iPhone”, Retrieved October 1, 2011, from http://www.slideshare.net/hrgeeks/iphone-forensics-without-the-iphone
[12]Cydia, Retrieved February 16, 2012, from http://cydia.saurik.com/
[13]K. David, “Jailbreaking iPhone Legal, U.S. Government Says”, July 27 2010, Retrieved August 12, 2011, from http://abcnews.go.com/Technology/us-government-Jailbreaking-iphone-legal/story?id=11254253
[14]Facebook for iPhone, Facebook, Retrieved October 3, 2011, from http://www.facebook.com/iphone
[15]Gartner: Worldwide Smartphone Sales Grew 47.3 Percent in Q4 2011, Retrieved February 15, 2012, from http://www.gartner.com
[16]iPhone and iPod touch: About backups. Retrieved August 10, 2011, from http://support.apple.com/kb/HT1766?viewlocale=zh_TW
[17]iTunes, Apple Inc. Retrieved October 11, 2011, from http://www.apple.com/tw/itunes/features/
[18]Micro Systemation XRY, Retrieved June 8, 2011, from http://www.msab.com/
[19]NPD: iPhone dominated in Q4, Android popularity grows among first-time buyers, Retrieved February 6, 2012, from http://www.npd.com
[20]plist Editor for Windows 1.0, iPodRobot.com, Retrieved July 12, 2011, from http://www.windows7download.com/win7-plist-editor-for-windows/htqyjntb.html
[21]Skype 3.5 for iPhone, Skype Limited. Retrieved October 6, 2011, from http://www.skype.com/intl/en-us/get-skype/on-your-mobile/download/iphone-for-skype/
[22]SQLite Database Browser. sourceforge.net, Retrieved August 15, 2011, from http://sqlitebrowser.sourceforge.net
[23]Viber Media Inc. Retrieved October 6, 2011, from http://www.viber.com/
[24]WhatsApp Inc. Retrieved October 6, 2011, from http://www.whatsapp.com/
[25]Windows live messenger, Microsoft, Retrieved October 6, 2011, from http://explore.live.com/windows-live-messenger-mobile