Memory fragment file reconstruction method and system based on structure chain reversion

Abstract

The invention belongs to the technical field of electronic forensics, and particularly relates to a memory fragment file reconstruction method and system based on structure chain reversion. The methodcomprises the following steps: scanning and analyzing a memory medium image, establishing mapping from a fragment set to a file fragment subset, and obtaining fragment elements in the file fragment subset; and based on reverse analysis of an operating system structure, constructing a connection relationship and a logic position of fragment elements in the file fragment subset, and reconstructingthe memory fragment file. According to the method, the memory fragment file engraving reconstruction based on a reverse structure chain is utilized to meet the electronic (digital) crime evidence obtaining practical application, the method can be suitable for recovering and analyzing a data file of the network intrusion behavior in a running physical memory based on the operating systems of different versions of Windows, and the practicability is high.

Description

technical field [0001] The invention belongs to the technical field of electronic forensics, and in particular relates to a method and system for reconstructing memory fragment files based on structure chain reverse. Background technique [0002] With the rapid development of information technology, cybercrime incidents occur frequently, such as telecom fraud, information extortion, and APT attacks. Digital forensics investigation has become one of the key technical means to stop and deter cybercrime. Disk forensics is an important investigative technique in the field of digital forensics, which is of great significance to the investigation of digital crimes. However, with the development of anti-forensics technology, network threats such as new "fileless attacks" only operate in memory and do not leave any trace information on the disk, which has stronger concealment and complexity. In addition, the ever-increasing capacity of disks leads to limitations in disk forensics....

AI Technical Summary

Problems solved by technology

Although there are many disk-based file carving algorithms, the application experiment results show that almost all of the generated file carving results are false results, and the accuracy is extremely low

In summary, the generality of fragmented data file carving algorithms based on memory images has not been well studied. In order to extract effective cybercrime-related file data and file behaviors from memory, explore new file types in physical memory. The engraving mechanism has very important theoretical significance and practical value

Images