Electronic evidence fixing and network evidence obtaining method and system based on memory evidence obtaining and block chain

Abstract

The invention discloses an electronic evidence fixing and network evidence obtaining method and system based on memory evidence obtaining and a block chain. An electronic evidence fixing terminal downloads a credible evidence obtaining tool through the block chain network. The legality of the evidence obtaining tool execution code is verified. The evidence obtaining tool is operated, electronic data are obtained, an operation log is generated, meanwhile, computer memory information is obtained through the memory evidence obtaining technology, and evidence fixing is conducted. A hash value is generated.and uploaded to the block chain network. A returned corresponding block chain address is received. The data is sent to a judicial certification authority terminal. A judicial certification mechanism terminal receives the block chain address sent by the electronic evidence fixing terminal. Information on the block chain is inquired, and legality is verified. The memory information is analyzed by adopting a memory evidence obtaining technology. The system state is extracted when the electronic evidence is obtained, and verifying the conformity. A judgment is verified whether the evidence obtaining tool is hooked or injected during operation or not through memory analysis, and the reliability of the operation environment of the evidence obtaining tool is verified. Judicial authentication reports are generated.

Description

technical field [0001] The disclosure belongs to the technical field of electronic forensics, and relates to a method and system for fixing electronic evidence and network forensics based on memory forensics and blockchain. Background technique [0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art. [0003] While modern information technology has brought convenience to people's work and life, it has also inevitably caused various negative problems, especially various crimes caused by the use of the Internet and information are showing a trend of increasing year by year, such as stealing state secrets Incidents such as disclosure of personal privacy, theft of online banking passwords, network fraud, and hacker attacks have emerged in an endless stream, and the criminal, civil, and administrative cases or disputes associated with them have also increased significantly. In ord...

AI Technical Summary

Problems solved by technology

In the above process, the process from step 1 to step 3 generally takes at least a few days. Since the data on the network or various network APPs are changing all the time, when the judicial appraisal agency fixes the electronic evidence, the data often has a large amount of time. changes, delaying the timing of evidence collection

In addition, when entrusting a judicial authentication agency to fix the evidence, because there was no communication with the lawyer or the court at that time, the evidence requirements were not very clear. When entrusting a judicial authentication agency to perform judicial authentication, there is often a certain degree of blindness, which will waste a certain amount of time and money. money

[0008] To sum up, due to the untimely forensics process of the conventional network electronic evidence collection process, the data you want to obtain is often deleted and other practical problems. A more credible method is needed to solve the current forensics problem.

Images