Unlock instant, AI-driven research and patent intelligence for your innovation.

Mirror image file simulation method and device, electronic equipment and storage medium

A technology of image files and simulation methods, applied in the field of computer applications, can solve problems such as difficulties in obtaining evidence of real materials in cases, failure to start and run normally, and achieve the effect of normal start and simulation

Pending Publication Date: 2022-05-06
奇安盘古(上海)信息技术有限公司
View PDF0 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0003] Currently, the latest version of virtual machine (VMware) mainly supports 512-byte sectors of the virtual disk, and does not support disks with 4K sectors, and most of the current Apple (mac) laptops have 4K sectors. disk, which cannot be successfully started and run normally during simulation, which brings difficulties in obtaining evidence for the real materials of the case

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Mirror image file simulation method and device, electronic equipment and storage medium
  • Mirror image file simulation method and device, electronic equipment and storage medium
  • Mirror image file simulation method and device, electronic equipment and storage medium

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0085] Embodiment 1: By modifying the boot sector of the virtual disk, the 4K sector boot information is converted to the 512 byte sector boot information, so as to be suitable for the virtual machine (VMware) 512 byte sector boot mode, and finally the 4K sector applet is completed. The image file of the (mac) system runs normally on the virtual machine, so as to complete the forensics task without human intervention. Its main process is as follows:

[0086] 1. In order to ensure the integrity of the forensic image file, snapshot processing must be performed on the original forensic image file at the beginning of the simulation, so that the modified content is recorded in the snapshot file. Therefore, the Apple (mac ) The image file of the system, using the snapshot technology under the framework of the virtual machine (VMware), to create the snapshot file.

[0087] 2. Analyze the snapshot file (without destroying the original image file), and analyze whether the system is a ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention provides a mirror image file simulation method and device, electronic equipment and a storage medium, and the method comprises the steps: modifying the starting information of a target mirror image file according to a sector data storage rule corresponding to a first disk sector type; wherein the disk sector type of the target mirror image file is a second disk sector type different from the first disk sector type, and the first disk sector type is a disk sector type supported by a virtual machine; and based on the modified starting information of the target mirror image file, starting the target mirror image file in the virtual machine for simulation. According to the mirror image file simulation method and device, the electronic equipment and the storage medium provided by the invention, normal startup and simulation of the target mirror image file in the virtual machine can be realized based on the startup information of the modified target mirror image file.

Description

technical field [0001] The invention relates to the technical field of computer applications, in particular to a mirror image file simulation method, device, electronic equipment and storage medium. Background technique [0002] A virtual machine refers to a complete computer system that has complete hardware system functions and runs in a completely isolated environment through software simulation. It can realize functions such as installing an operating system, running applications, and accessing network resources. In computer forensics, it is an important link in the field of forensics to simulate the acquired image file in a virtual machine. [0003] Currently, the latest version of virtual machine (VMware) mainly supports 512-byte sectors of the virtual disk, and does not support disks with 4K sectors, and most of the current Apple (mac) laptops have 4K sectors. disk, which cannot be successfully started and run normally during simulation, which brings difficulties in ...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): G06F11/14G06F9/455G06F16/11
CPCG06F11/1448G06F11/1458G06F16/128G06F9/45558G06F2009/45562
Inventor 黄玉兔李亚洲李小军
Owner 奇安盘古(上海)信息技术有限公司