A kind of method recovering mobile phone audio files
Technical field
The present invention relates to field of information security technology, in particular to a kind of method recovering mobile phone audio files.
Background technology
Along with the recoverable amount of mobile phone in social groups gets more and more, mobile phone types of applications software is multifarious, from cuisines to lodging, from trip to finance, also more and more be unable to do without mobile phone from shopping to social people.
Information spinner in mobile phone to be divided into 2 big class recording modes, and one is text mode, and one is audio frequency and video mode. Early stage instant message information is all transmit in text mode, and the appearance along with all kinds of social APP, it may also be useful to audio frequency and video mode transmits the mode of information, increases year by year. The input mode more convenient and quicker of audio frequency and video, reliable letter is higher, and recognition capability is more strong.
In mobile phone audio files, again based on AMR file layout and SILKV3 file layout, perhaps these audio files are exactly the electronic evidence of certain case, but cannot find because of being deleted; Can find it is thus desirable to a kind of and recover the method for audio file.
Summary of the invention
The present invention is directed to the defect of prior art, it provides a kind of method recovering mobile phone audio files, can effectively solve above-mentioned prior art Problems existing.
Recover a method for mobile phone audio files, comprise step below:
S1: the storage space of searching handset, looks for audio file header feature;
S2: judge file type after finding audio file header feature;
S3: the structure resolving audio file frame according to file type format, and the bottom data of combining audio file;
S4: extract and re-create audio file.
As preferably, described S3 concrete steps are:
S301: look for the frame header after file head feature;
S302: the length calculating frame data according to frame header;
S303: intercept the data that frame header rear length is frame length degree, judging that whether this section of data are correct frame data, if then performing S304, then performing S307 if not;
S304: judge whether to find 50 correct frame data, if then performing S306, then performs S305 if not.
S305: the frame header finding next frame, after the head of next frame is positioned at former frame data, performs S302;
S306: 50 correct frames are formed 1 second audio frequency data in logic, continues to perform S305;
S307: multiple audio frequency data are extracted, and is combined as, according to the form of file head+frame, the audio frequency that can play.
As preferably, described S302 is specially:
If searching is SILK file, then calculate frame size by the little end data of frame header after file head:
If searching AMR file, then by frame header after file head, obtaining bit rate, then passing through formula:
Bit rate is multiplied by the bit that 1000 equal 1 frame divided by 50, then bit is converted to byte, and the integer getting byte adds the size that a byte is frame data.
Compared with prior art it is an advantage of the current invention that: the audio file in mobile phone can be found accurately, and judge audio file form and according to format analysis audio file structure and combining audio form is the form that can play, can find efficiently and recover audio format file, help personnel in charge of the case to find the audio electronics evidence in mobile phone.
Embodiment
For making the object of the present invention, technical scheme and advantage clearly understand, by the following examples, the present invention is described in further details.
Recover a method for mobile phone audio files, comprise step below:
S1: the storage space of searching handset, looks for audio file header feature; In bottom data, " 0x02232153494C4B5F5633 " is SILK file head, and " 0x2321414D520A " is AMR file head.
S2: judge file type after finding audio file header feature is SILK file or AMR file;
S3: the structure resolving audio file frame according to file type format, and the bottom data of combining audio file;
S4: extracting and create the audio file of combination, separately deposit as file by the bottom data that S3 combines, this file can be played.
Described S3 concrete steps are:
S301: look for the frame header after file head feature;
S302: the length calculating frame data according to frame header;
S303: after intercepting frame header, length is the data of frame length degree, judge that whether this section of data are correct frame data (to be judged whether that correct frame data need to be realized by SkypeSILKcodec algorithm), if then performing S304, then perform S307 if not;
S304:: judge whether to find 50 correct frame data, if then performing S306, then performs S305 if not.
The logical organization of audio file is file head+N number of frame, and the structure of frame is frame head+frame data;
But need 50 correct frame data just can be spliced into the energy normal play audio frequency of 1 second;
S305: find the frame header (head of next frame be positioned at former frame data after) of next frame to perform S302;
S306: 50 correct frames are formed 1 second audio frequency data in logic, continues to perform S305;
S307: multiple audio frequency data are extracted, and is combined as, according to the form of file head+N number of frame, the audio frequency that can play.
Described S302 is specially
If searching is SILK file, then calculate frame size by the little end data of frame header (being 2 bytes) after file head:
If searching AMR file, then by frame header after file head, obtaining bit rate, passing through formula:
Bit rate is multiplied by the bit that 1000 equal 1 frame divided by 50, then bit is converted to byte, and the integer getting byte adds the size that a byte is frame data.
Such as frame header is " 0x0C " corresponding 5.15 bit rates, and 5150/50=103bit=12.875byte, and getting whole is 13 bytes, adds the frame head of a byte, is 14 bytes, and this 14 is directly the size of this frame.
The those of ordinary skill of this area, it will be appreciated that embodiment described here is the implementation method in order to help reader understanding the present invention, should be understood to that protection scope of the present invention is not limited to such special statement and embodiment. The those of ordinary skill of this area can make various other various concrete distortion and combination of not departing from essence of the present invention according to these technology disclosed by the invention enlightenment, and these distortion and combination are still in protection scope of the present invention.