Evidence obtaining method, device and equipment supporting multiple operating systems and storage medium

Abstract

The invention discloses an evidence obtaining method supporting multiple operating systems, and belongs to the field of computer evidence obtaining. The method comprises the following steps: running an evidence obtaining system on an evidence obtaining object according to a starting instruction; if the starting instruction is a cold starting instruction, running the offline evidence obtaining system to recognize the operating system type of the evidence obtaining object, and starting a corresponding analysis module in the offline evidence obtaining system according to the operating system type; and if the starting instruction is a direct running instruction, running the on-line evidence obtaining system to identify the operating system type of the evidence obtaining object, and starting acorresponding on-line evidence obtaining module in the on-line evidence obtaining system according to the operating system type. According to the invention, the corresponding evidence obtaining modulecan be started in a targeted manner to obtain evidences according to the type of the operating system contained in the evidence obtaining object, and evidence obtaining of three systems is supportedat the same time.

Description

technical field [0001] The invention relates to the field of computer evidence collection, in particular to a method, device, equipment and storage medium supporting multiple operating systems. Background technique [0002] With the increasing number of computer crime cases and the digitalization of crime methods, the work of collecting electronic evidence has become the key to providing important clues and solving cases. [0003] At present, the online forensics methods for computers are all based on specific computer operating system types, and it is impossible to implement one method to support online and offline online forensics for computers with multiple operating systems. Therefore, in the face of on-site evidence collection, the forensics personnel need to carry various forensic tools, because it is impossible to know in advance what the computer operating system that the on-site evidence collection is facing is. [0004] In a nutshell, the existing technology has t...

AI Technical Summary

Problems solved by technology

[0003] At present, the online forensics methods for computers are all based on specific computer operating system types, and it is impossible to implement a method that supports online and offline online forensics for computers with multiple operating systems.

Therefore, in the face of on-site evidence collection, forensic personnel need to carry various forensic tools, because it is impossible to know in advance what the computer operating system that the on-site evidence collection is facing

[0004] In a nutshell, the existing technology has the following major problems: 1. There is no forensics method that supports offline and online forensics; 2. There is no method that simultaneously supports Windows, macOS system traces, user trace analysis, and image forensics; 3. There is no way to simulate a virtual CD through a U disk as an offline start-up method for offline forensics; 4. It does not support Apple macOS system computer online online forensics

Images