Method and system for realizing collaborative forensics analysis on remote forensics target terminal

Abstract

The invention relates to a method for achieving synergic forensic analysis on a remote forensic target terminal. The method comprises the following steps: dividing forensic analysis scripts into a plurality of corresponding basic operation unit sequences through the remote forensic target terminal; judging whether all basic operation unit sequences have repeated basic operation unit sequences or not through the terminal; if the basic operation unit sequences have repeated basic operation unit sequences, combining the repeated basic operation unit sequences, or else associating the basic operation unit sequences with a forensic analysis data target, and performing corresponding operation on the forensic analysis data target associated with the basic operation unit sequences according to the basic operation unit sequences. The invention further provides a system for achieving synergic forensic analysis on the remote forensic target terminal. The system comprises a forensic server and a forensic script interpreter. By adopting the method and the system provided by the invention, the forensic scripts are interpreted into specific forensic behavior and the forensic behavior is reasonably combined and optimized, so that the reliability of digital forensic analysis and the analysis processing efficiency are improved, and the method and the system have a relatively wide application range.

Description

technical field [0001] The present invention relates to the field of forensic analysis, in particular to the field of remote cooperative forensic analysis, and specifically refers to a method and system for realizing collaborative forensic analysis of remote forensic target terminals. Background technique [0002] In the process of digital forensics, the analysis process of forensic data often depends on the personal experience and thinking and judgment of the forensic personnel to choose the appropriate analysis method to realize the detection and analysis of the forensic data, because the analysis of the forensic data by the forensic personnel often involves Multiple analysis methods, such as file system analysis, log analysis, and local user data analysis. This personal subjective choice of forensic analysis method is not only not conducive to the full and effective use of forensic data, but also has a negative impact on the efficiency of forensics. In addition, the numb...

AI Technical Summary

Problems solved by technology

This personal subjective choice of forensic analysis method is not only not conducive to the full and effective use of forensic data, but also has a negative impact on the efficiency of forensics

In addition, the number of cases requiring forensic identification has increased year by year, but the number of forensics personnel is limited, and it is impossible to arrive at the scene in time to collect evidence, and personal experience is limited, so it is difficult to conduct evidence collection in all aspects

Images