Abstract: Smartphone has gradually become one of important sources of information in the current electronic forensics investigation. Aiming at the difficult problem of information acquisition when the picture of the Android smartphone was deleted or damaged, a file recovery method based on WinHex tools is provided. In experiments, by creating a cell phone store image and the header and tail sign of file, the phone's image files were extracted.

Key words: smartphone, Android system, WinHex tools, image, electronic forensics

摘要： 智能手机已逐渐成为当前电子取证调查中重要的信息来源之一.针对Android智能手机的图片被删除或被损坏时信息获取困难的问题，提出了一种基于WinHex工具的文件恢复方法.在实验中，通过创建手机存储镜像，分析文件头尾部标识，成功提取了手机的图片文件.

关键词: 智能手机, 安卓系统, WinHex工具, 图片, 电子取证