The application belongs to the technical field of
data analysis, and discloses a case clue acquisition method and
system based on intelligent terminal forensics data, which comprises the following steps: collecting multi-source forensics data from an intelligent terminal device, performing
time synchronization, denoising and format unification
processing on the collected multi-source forensics data, extracting a behavior
feature vector and mapping it to a unified feature space, and outputting a standardized
feature set; combining the standardized
feature set with a corresponding time
label to generate a tamper-proof forensics
fingerprint, constructing a double-index
storage structure according to time and geographical dimensions, and performing cross-terminal evidence retrieval, integrity
verification and tracing; according to the standardized
feature set and the tamper-proof forensics
fingerprint, the identity and instrument association of cross terminals are checked through behavior signature consistency representation; a subthreshold cumulative trigger mechanism is adopted to cumulatively evaluate the behavior features of the intelligent terminal within a preset time window, and an identity-instrument consistency assertion is output; and the case reasoning accuracy and case clue acquisition efficiency are improved.