Electronic evidence fixation and network forensics method and system based on memory forensics and blockchain

Abstract

The invention discloses a method and system for fixing electronic evidence and network forensics based on memory forensics and block chain. The electronic evidence fixing terminal downloads a credible forensic tool through the block chain network; verifies the legality of the execution code of the forensic tool; runs the forensic tools to obtain electronic data, generate operation logs, and use memory forensics technology to obtain computer memory information and fix evidence; generate hash values, upload them to the blockchain network, and receive the returned corresponding blockchain addresses; send them to the judiciary Appraisal institution terminal; Judicial appraisal institution terminal receives the blockchain address sent by the electronic evidence fixed terminal; queries the information on the blockchain to verify the legitimacy; uses memory forensics technology to analyze the memory information, extracts the system status when the electronic evidence is acquired, and verifies Conformance; use memory analysis to verify whether the forensics tool is hooked or injected during operation, and verify the reliability of its operating environment; generate a forensic report.

Description

technical field [0001] The disclosure belongs to the technical field of electronic forensics, and relates to a method and system for fixing electronic evidence and network forensics based on memory forensics and blockchain. Background technique [0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art. [0003] While modern information technology has brought convenience to people's work and life, it has also inevitably caused various negative problems, especially various crimes caused by the use of the Internet and information are showing a trend of increasing year by year, such as stealing state secrets Incidents such as disclosure of personal privacy, theft of online banking passwords, network fraud, and hacker attacks have emerged in an endless stream, and the criminal, civil, and administrative cases or disputes associated with them have also increased significantly. In ord...

AI Technical Summary

Problems solved by technology

In the above process, the process from step 1 to step 3 generally takes at least a few days. Since the data on the network or various network APPs are changing all the time, when the judicial appraisal agency fixes the electronic evidence, the data often has a large amount of time. changes, delaying the timing of evidence collection

In addition, when entrusting a judicial authentication agency to fix the evidence, because there was no communication with the lawyer or the court at that time, the evidence requirements were not very clear. When entrusting a judicial authentication agency to perform judicial authentication, there is often a certain degree of blindness, which will waste a certain amount of time and money. money

[0008] To sum up, due to the untimely forensics process of the conventional network electronic evidence collection process, the data you want to obtain is often deleted and other practical problems. A more credible method is needed to solve the current forensics problem.

Images