As the connection between human life and smart phones becomes close, mobile devices store a large amount of private information. Forensic personnel can obtain information related to criminal through mobile phones, but the traditional mobile phone forensics system is limited to a simple analysis of the original information and can’t find the hidden relationship between data. This article will introduce a method based on K-means clustering and association rule mining to improve the traditional forensics system. Through the cluster analysis of basic information, the relationship between suspects and their contactors can be explored. At the same time, association rules mining can be used to analyze the behavior of suspects so as to predict the time and contact of each event. Help law enforcement agencies find evidence hidden behind the data and improve the efficiency of handling cases.