Method for Realizing Electronic Data Forensics Analysis Based on Custom Script in Forensics Software

Abstract

The invention relates to a method for realizing electronic data forensics analysis based on a self-defined script in forensics software, which includes: compiling and processing the custom script by the forensics software, and obtaining the object of forensics analysis; The collected electronic data is normalized, and the corresponding electronic data tree is obtained; the forensic software performs correlation analysis between the forensic analysis object and the electronic data tree, and obtains the forensic analysis result. Adopt the method for realizing electronic data forensics analysis based on self-defined scripts in the forensics software of the present invention, unbind the forensics analysis logic and the forensics analysis software through the self-defined scripts, make the software framework of the forensics software more open, and make the forensics software in the running process It is not limited by application software, and different custom scripts can be loaded for different software. The forensics method is flexible and changeable, which improves the efficiency of forensics, speeds up the analysis process, and has a wider range of applications.

Description

technical field [0001] The invention relates to the field of data analysis, in particular to the field of electronic data forensics and analysis, and specifically refers to a method for realizing electronic data forensics and analysis in forensics software based on a custom script. Background technique [0002] With the increasing number of computer crime cases and the digitalization of crime methods, the work of collecting electronic evidence has become the key to providing important clues and solving cases. Restoring damaged computer data and providing relevant electronic data evidence is electronic forensics. However, with the rapid development of the mobile Internet and the rapid transfer of traditional network applications to the mobile Internet, electronic data forensics will face traces of the use of more types of applications. analyze. Traditional electronic data forensics software mainly proposes forensic analysis techniques and solutions for corresponding applicat...

AI Technical Summary

Problems solved by technology

[0003] 1. The applications supported by the electronic data forensics software are limited. Once the supported application range is exceeded, it will not be able to provide forensics support

[0004] 2. Since each software is developed relatively independently, the software architecture is relatively closed, and it is difficult for users to customize and edit. It is impossible to share the forensics ideas of forensics experts, and it is also impossible to combine multiple forensics ideas.

Images