Credible extraction method for digital evidence of Android

Abstract

The invention provides a credible extraction method for digital evidence of Android. The credible extraction method comprises the following steps: step 1, data are extracted from a mobile device, and timestamp information and a unique device identification number are obtained; a data verification technology is used for acquiring a hash value of a result of the step 1; a DES symmetric encryption algorithm is adopted for packaging and encrypting the hash value, the data, the timestamp information and the unique device identification number through a shared key generated randomly by an evidence obtaining client-side; an RSA asymmetric cryptographic algorithm is adopted for encrypting the shared key through a public key distributed by an evidence obtaining server, and the encrypted shared key is sent to the evidence obtaining server; after the evidence obtaining server receives the data, a private key of an RSA algorithm is used for decryption to obtain the shared key, and the shared key is used for decryption to obtain the hash value and a data package; a HASH algorithm is applied to the data package to obtain a new hash value, and whether the two hash values are the same is judged through comparison. The credible extraction method for the digital evidence of Android can improve the originality and false accusation forbiddingness of the data.

Description

technical field [0001] The invention relates to the technical field of digital evidence collection, in particular to an Android-oriented trusted extraction method of digital evidence. Background technique [0002] Digital forensics technology includes electronic forensics, network forensics, computer forensics, etc. It is a technology and tool for collecting and discovering evidence from computers, mobile electronic devices and other related electronic devices. Its purpose is to investigate digital crimes related to digital technology, such as e-commerce fraud, intellectual property infringement, computer intrusion, etc., to effectively ensure the security of relevant information in digital devices such as computers, mobile phones, and communication networks, and to build an overall information security framework. , to prevent network security and other related attacks, and assist enterprises and judicial agencies to collect evidence of digital crimes. The present invention...

AI Technical Summary

Problems solved by technology

However, attackers can still bypass security access control by using technical means such as network proxy or broadcast monitoring, resulting in data being illegally obtained by criminals on the network from the forensics client to the server.

Images