GA/T 1571-2019Forensic sciences - Examination methods for functions of Android applications (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

Please note that some elements of this document may involve patents. Publication of this document the agency is not responsible for identifying these patents.

This standard was proposed by the National Criminal Technical Standardization Technical Committee Electronic Material Evidence Inspection Sub-Technical Committee Out.

This standard is under the jurisdiction of the National Criminal Technology Standardization Technical Committee (SAC/TC 179).

This standard was drafted. Cyber Security Bureau of the Ministry of Public Security, Chongqing Public Security Bureau.

1 Scope

This standard specifies the methods used in the field of forensic science to test the functionality of Android system applications.

This standard applies to the functional testing of specific applications of the Android system in the field of forensic science.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only the dated version applies to this document.

Pieces. For undated references, the latest version (including all amendments) applies to this document.

GA/T 756-2008 Digital Equipment Evidence Data Discovery Extraction Fixed Method GA/T 757-2008 Program Function Inspection Method GA/T 828-2009 Technical Specification for Electronic Material Evidence Software Inspection

3 Terms and definitions

The terms and definitions defined in GA/T 756-2008, GA/T 757-2008, GA/T 828-2009 and the following apply to this document.

Android application

Programs running on the Android system with one or more specific functions.

Decompile

The process of restoring application files into assembly or high-level language code.

4 Equipment

5 Inspection steps

6 Inspection opinions

List the detected application functions in order according to the inspection. Such as checking out applications with sending emails, listening to intercepting and forwarding short messages, the functions of monitoring and modifying outgoing calls and obtaining (such as GPS) positioning should be listed separately.

7 Supplementary Provisions

7.1 The inspection process meets the following requirements.

a) Inspection records should be made;

b) the data in the inspection object should not be changed;

c) The detected data should be stored in a dedicated storage medium;

d) The inspection process should be recorded simultaneously.

7.2 The objects to be submitted for inspection shall be protected against water, magnetism, static electricity and shock.