File decryption and evidence collection method and device in storage medium

Abstract

The invention discloses a file decryption and evidence collection method and device in a storage medium, and relates to the technical field of data processing. The method for decrypting and extractingthe file comprises the following steps: connecting a storage medium such as a USB flash disk for inspection to inspection equipment through a read-only interface; opening the storage medium to be inspected by using tool software; exporting the folder Thumbs.dn to be decrypted and the mobile encryption program to a local directory; reading a character array with the name of 117789687 below the Thumbs.dn folder, and writing the character array into the Tumbs.dn folder; converting the character string array into a character string according to ASCII coding; Decryption operation on character strings, storing all operation results in a new character array according to a sequence; converting the array into a character string in a UTF8 coding mode; A result is a secret key, a mobile encryption software program is operated under the same Thumbs.dn catalog, the point is determined after the secret key is input, original files appear under the catalog, compared with a traditional extraction method, the speed is high, names of all the files are original file names, and the integrity of the original files is guaranteed.

Description

technical field [0001] The invention relates to the field of file decryption and evidence collection, in particular to a method and device for file decryption and evidence collection in a folder-encrypted storage medium. Background technique [0002] With the rapid development and widespread popularization of mobile storage devices, the information contained in the storage media has become an important source of clues and evidence for criminal investigation. Due to the enhanced anti-investigation awareness of criminals, the TF cards and U disks involved in the case often contain encrypted files, especially in cases involving cult organizations, folder encryption is common. In order to solve cases, maintain social stability, and crack down on crimes, it is extremely important to decrypt, restore, and collect evidence. [0003] During the technical inspection of storage media such as TF cards, SD cards, and U disks, the inventor encountered a folder encryption software (herei...

AI Technical Summary

Problems solved by technology

[0005] One is that after using software such as X-ways to restore the encrypted USB flash drive, the file name cannot be obtained. After forced data recovery, the file names are serial numbers with Arabic numerals increasing in sequence, and the integrity of the data file cannot be guaranteed.

In the case of a huge amount of data, it is impossible to intuitively obtain the approximate content of the file through the file name

The second is that the efficiency is relatively low. When inspecting a large number of inspection materials, the files in the medium cannot be quickly restored.

Images