Electronic evidence fixing method, terminal device and storage medium

Abstract

The invention relates to an electronic evidence fixing method, a terminal device and a storage medium. The method comprises the following steps of 1, compressing data information and adding the compressed data information to a buffer queue A; 2, collecting data contents, adding the collected data contents to a buffer queue B, encrypting and compressing the data contents in the buffer queue B, andadding the encrypted and compressed data contents to the buffer queue A; 3, judging whether data blocks in the buffer sequence A meet standardization requirements or not in real time; 4, constructingaddressing list data in the buffer queue A, encrypting the addressing list data, and adding the encrypted addressing list data to an addressing list data region; 5, copying the data blocks in the buffer sequence A to a backup region of a mirror image file; and 6, constructing a file control region in the mirror image file. Through simplified structured design, network resources comprised in computer software and hardware can be effectively and correctly fully utilized in the creation and usage processes of the evidence mirror image file.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to an electronic evidence fixing method, a terminal device and a storage medium. Background technique [0002] The first step in electronic data forensics is evidence fixation. Evidence fixation refers to the process of obtaining data from suspect computers or storage media or mobile terminals. Evidence fixation must comply with strict operational norms, and it needs to be carried out by qualified personnel using professional data acquisition tools. At the same time, the mirror file needs to be judged to be judicially valid. [0003] There are mainly two storage methods for evidence immobilization, one is to copy and store electronic evidence bit by bit on the target storage medium, and the other is to make electronic evidence into a mirror image file. The main fixed method of early electronic data forensics is the first target storage medium bit-to-bit copy s...

AI Technical Summary

Problems solved by technology

[0014] Insufficient foresight of the speed and scale of the increase in storage capacity of the storage medium, and flaws in the structural design make the computer unable to effectively manage the memory during application

[0015] Insufficient foresight of the scene changes in the application of the forensic system, as well as flaws in the structural design, cannot efficiently support multi-terminal, multi-task concurrent distributed forensic analysis

Images