Method for locating geographical position of disk based on protocol head of hyper text transfer protocol (HTTP)

Abstract

The invention discloses a method for locating a geographical position of a computer hard disk. The method comprises the following steps of: extracting protocol head information of a hyper text transfer protocol (HTTP) in the computer hard disk; constructing a geographical position name tree and a two-dimensional weight value linked list, scanning a Cookie data area of the HTTP protocol head, traversing the geographical position name tree for matching the geographical position name tree with each Cookie data area, if the matching succeeds, performing add operation on weights of nodes; constructing a data dictionary, and sequencing the data dictionary according to the sizes of weight values; and scanning a Data area in the HTTP protocol head, and acquiring the time when the computer hard disk is located at a certain historical position, so that strong physical evidence can be provided for criminal investigation work. According to the method, manual intervention is not required in a forensics process, disk scanning, calculation and final result generation can be automatically realized, operating cost is low, deployment is easy, and the method is applied to the field of computer hard disk digital forensics and has a wide application prospect.

Description

technical field [0001] The invention relates to a computer hard disk digital forensics technology, which belongs to the technical field of information security. Background technique [0002] The application and popularization of computers have led to an increase in criminal activities based on computer networks, and many users' daily network operations will be recorded in their hard drives by computers. In the field of computer digital forensics, detecting the hard disk of a computer and obtaining its geographic location information at a specific historical time will help criminal investigators obtain case clues and provide powerful evidence for the court. It is difficult to obtain the historical geographic information of a computer hard disk that is not connected to the Internet, because the traditional network delay geographic location positioning method and the IP address positioning method require the device to connect to the Internet, and the exact geographic location c...

AI Technical Summary

Problems solved by technology

[0003] The application of Chinese Patent Publication No. CN101383855 discloses a method for obtaining precise geographic location information of a computer based on IP address information, but this method needs to maintain a huge database, and users can only visit its website to obtain the location of a given IP address information

For mobile computer users, their IP address changes with the movement of the user's geographic location. This method cannot obtain the user's IP address at a historical moment, and thus cannot locate the historical geographic location of the computer.

The application with the patent publication number CN1190481 discloses a storage medium carrying geographic location data. This method needs to encode the storage medium in advance. For storage devices without encoding in advance, this method is not available, so it has great limitations sex

Images