Electronic evidence obtaining method and device, evidence obtaining equipment and medium

Abstract

The invention provides an electronic evidence obtaining method and device, evidence obtaining equipment and a computer readable medium. The method comprises the steps of obtaining cleanliness check information in a current evidence obtaining environment, wherein the cleanliness check information comprises evidence obtaining environment information, network configuration information, an installed software list, a system installed patch and an application software cache; performing cleanliness evaluation on the current evidence obtaining environment according to the cleanliness inspection information to obtain a corresponding cleanliness evaluation value, so that a user judges whether evidence obtaining is performed in the current evidence obtaining environment or not according to the cleanliness evaluation value; if a forensic starting instruction of the user is received, starting evidence obtaining in the current forensic environment; and if an evidence obtaining stopping instruction of the user is received, stopping obtaining evidence in the current evidence obtaining environment. According to the scheme, a user can conveniently and comprehensively check the cleanliness of the evidence obtaining environment, and therefore the due legal efficacy of electronic evidences is guaranteed.

Description

technical field [0001] The present application relates to the field of information technology, in particular to a method and device for obtaining electronic evidence, a device for obtaining evidence, and a computer-readable medium. Background technique [0002] With the popularization of various information technologies, more and more electronic data are generated in our lives, and these electronic data have gradually become important evidence of network behavior. [0003] In 2012, my country's relevant laws (Civil Procedure Law and Criminal Procedure Law) gave electronic data the status of formal evidence. Because electronic data is dynamic and easily tampered with, in judicial practice, the party producing evidence needs to obtain and fix electronic evidence in a timely manner, and prevent electronic data from being tampered with, so as to avoid the evidence being questioned. [0004] There are two main ways to prevent electronic data from being tampered with: the first t...

AI Technical Summary

Problems solved by technology

[0004] There are two main ways to prevent electronic data from being tampered with: the first type is to ensure that the data has not been tampered with by calculating the summary of the electronic data after forensics, but this method cannot guarantee that the electronic data has not been tampered with before the summary is calculated. The second method is to ensure the cleanliness of the evidence collection environment. If the computer used for evidence collection is safe and does not contain malicious programs, then the electronic data obtained through the computer is safe and has not been tampered with.

For the second type of method, the existing method is too cumbersome for ordinary users and is not easy to use

Images