中文摘要：

智能手机已逐渐成为当前电子取证调查中重要的信息来源之一.针对Android智能手机的图片被删除或被损坏时信息获取困难的问题,提出了一种基于WinHex工具的文件恢复方法.在实验中,通过创建手机存储镜像,分析文件头尾部标识,成功提取了手机的图片文件.

英文摘要：

Smartphone has gradually become one of important sources of information in th e current electronic forensics investigation. Aiming at the difficult problem of information acquisition when the picture of the Android smartphone was deleted or damaged, a file recovery method based on WinHex tools is provided. In experiments, by creating a cell phone store image and the header and tail sign of file, the phone＇s image files were extracted.