本文介绍了基于Android平台的智能手机应用MTP协议^[1]在PC机构建的一个虚拟文件系统^[2]中进行案件检验的实例。涉案手机因设置了手机防盗锁且USB调试未打开,现有的手机取证工具无法对其数据进行提取。通过查询手机生产日期推断该手机版本支持MTP协议, 并尝试利用MTP协议查看和拷贝手机内的文件,最终找到QQ文件夹下保存的解锁密码,解除屏幕锁后利用现有手机取证工具成功提取到涉案手机中的短信息、即时通讯记录等与案件相关的信息,为手机检验中破解第三方软件设置的屏幕锁解锁提供了一种新的方法。

This paper introduces digital forensic examination on Android smart phone using MTP protocol to build up a virtual file system in PC. By the request of MTP protocol, PC can operate and then view and copy files on some Android smart phones. The data from the phone involved in the case could not be extracted with current smart phone forensic tools, because it set up a mobile phone anti-theft lock and USB debugging was not open. The author queried the production date of smart phone and concluded the Android System version was supported by MTP protocol, which was used to find password in Tencent folder and exact SMS\IM records from the phone. Therefore, this paper provides a new method for unlocking smart phone whose screen lock is set by third party software.