Webpage-based equipment evidence obtaining method

Abstract

The invention relates to an equipment evidence obtaining method based on a webpage. The method comprises the following steps: deploying a webpage front end of an evidence obtaining system on a server; deploying a resident service on each evidence obtaining computer; the server responds to the access of a user to the front end of the webpage and sends a service notification to all the evidence obtaining computers; the resident service of each evidence collection computer obtains a device detection program of a target version according to the service notification, then starts the device detection program to detect a device to be subjected to evidence collection connected with the device detection program, and sends a detection result to the server; based on the detection result, the server displays all the devices to be subjected to evidence collection through the webpage front end for a user to select; and obtaining a target to-be-evidence-taken device selected by the user and carrying out evidence taking operation. According to the method, the equipment evidence obtaining efficiency can be improved, and the real-time performance and safety of evidence obtaining operation are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic data forensics, and in particular to a device forensics method based on a web page. Background Art

[0002] Currently, mobile phone forensics products on the market are mainly implemented in the form of clients. Although these products are powerful, there are many challenges in their upgrade and maintenance. Specifically, if the forensics client is installed on multiple computers, each client upgrade needs to be manually updated on each computer. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a web-based device evidence collection method, which can improve the efficiency of device evidence collection and ensure the real-time and security of the evidence collection operation.

[0004] The technical solution adopted by the present invention to solve the technical problem is: to provide a device evidence collection method based on a web page, comprising the following steps:

[0005] Deploy the web front end of the forensic system on the server;

[0006] Deploy a resident service on each forensic computer;

[0007] The server responds to the user's access to the web front end and sends a service notification to all of the forensic computers;

[0008] The resident service of each of the forensic computers obtains the target version of the device detection program according to the service notification, and then starts the device detection program to detect the connected device to be forensically collected, and sends the detection result to the server;

[0009] Based on the detection result, the server displays all the devices to be forensically collected through the web front end for user selection;

[0010] Get the target device selected by the user and perform evidence collection operations.

[0011] Furthermore, the evidence collection operation includes the following steps:

[0012] Obtaining the user's evidence collection plan through the web front end;

[0013] The server sends a task instruction to a target forensic computer according to the forensic scheme, and the target forensic computer is the forensic computer connected to the target forensic device;

[0014] The resident service of the target forensic computer obtains the corresponding task plug-in according to the task instruction, and then starts the task plug-in to perform forensic operations on the target forensic device.

[0015] Furthermore, it also includes:

[0016] The resident service of the target forensic computer obtains data collection progress in real time, and synchronizes the data collection progress to the web page front end for display through the server.

[0017] Furthermore, the step of responding to the user's access to the webpage front end and sending a service notification to the target forensic computer includes:

[0018] Monitor WebSocket events of the web page front end;

[0019] When the WebSocket connection is successfully established, a service notification is sent to the target forensic computer.

[0020] Furthermore, the target forensic computer obtains the target version of the device detection program from the server according to the service notification.

[0021] Furthermore, the server is an intranet server.

[0022] Furthermore, the target version is the latest version.

[0023] Furthermore, the target forensic computer adopts silent startup when starting the device detection program.

[0024] Beneficial Effects

[0025] Due to the adoption of the above-mentioned technical scheme, the present invention has the following advantages and positive effects compared with the prior art: the present invention greatly simplifies the upgrade and maintenance of the system by deploying a resident service on the forensic computer. Any update or new function on the server only needs to be operated once on the server side, and the resident service can automatically pull the latest program and plug-in. Through centralized management, all forensic computers immediately adapt to the new function after the server side is upgraded, and there is no need to manually upgrade the client side one by one, which reduces maintenance time and cost and improves work efficiency; the resident service can automatically obtain the latest program and plug-in without connecting to the external network, thereby avoiding the problem of being unable to use new or optimized forensic functions due to untimely client upgrades, ensuring the functional integrity of the forensic process, while reducing potential safety hazards and ensuring the real-time and security of the system; the present invention deploys the web front end of the forensic system on the server, and the user only needs to access the intranet server through a browser to complete the forensic operation without installing the client, thereby improving the efficiency and applicability of forensics. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] The embodiment of the present invention relates to a mobile phone evidence collection method based on a web page, comprising the following steps:

[0029] 1. Deploy web front-end and resident services:

[0030] Deploy the web front-end of the forensic system on the server.

[0031] A resident service is deployed on each forensic computer. The resident service is responsible for real-time interaction with the server to achieve device detection and task initiation. The design goal of the resident service is to simplify the upgrade and maintenance of the forensic computer, so that it can easily adapt to new functions and task requirements.

[0032] 2. Mobile device detection:

[0033] Establish a connection with the web page through the server:

[0034] When a user accesses the forensic system through a browser, the server establishes a connection with the web page through the WebSocket (ws) protocol and then sends a notification to the resident service on the forensic computer.

[0035] Pulling equipment detection procedure:

[0036] After receiving the notification, the resident service pulls the latest device detection program from the server and automatically starts the program on the forensic computer silently (without the user's awareness).

[0037] Equipment test results display:

[0038] After the device detection program is run, it scans all devices connected to the forensic computer. The detection results are transferred through the server and displayed on the web interface for users to select and operate.

[0039] 3. Perform evidence collection tasks:

[0040] Get the target device:

[0041] Based on the device detection results, the user selects the target device for which forensics needs to be collected on the web interface.

[0042] Notify the server:

[0043] After the user selects the target device, the web page sends the selected device information and related task instructions to the server.

[0044] Resident service pull task plug-in:

[0045] After receiving the task instruction, the server notifies the resident service. The resident service will pull the corresponding task plug-in from the server and start the execution on the forensic computer (without the user's awareness).

[0046] Real-time synchronous acquisition process:

[0047] During the task execution, the resident service will synchronize the real-time collection progress to the web interface through the server, and users can monitor the collection progress and results in real time.

Claims

1. A web-based device evidence collection method, characterized in that: The following steps are involved: Deploy the web front end of the forensic system on the server; Deploy a resident service on each forensic computer; The server responds to the user's access to the web front end and sends a service notification to all the evidence collection computers; the resident service of each of the evidence collection computers obtains the target version of the device detection program according to the service notification, and then starts the device detection program to detect the connected device to be collected, and sends the detection result to the server; Based on the detection result, the server displays all the devices to be forensically collected through the web front end for user selection; Get the target device selected by the user and perform evidence collection operations.

2. The method according to claim 1, characterized in that The evidence collection operation includes the following steps: Obtaining the user's evidence collection plan through the web front end; The server sends a task instruction to a target forensic computer according to the forensic scheme, and the target forensic computer is the forensic computer connected to the target forensic device; The resident service of the target forensic computer obtains the corresponding task plug-in according to the task instruction, and then starts the task plug-in to perform forensic operations on the target forensic device.

3. The method according to claim 2, characterized in that Also includes: The resident service of the target forensic computer obtains data collection progress in real time, and synchronizes the data collection progress to the web page front end for display through the server.

4. The method according to claim 1, characterized in that: The method of responding to the user's access to the web front end and sending a service notification to the target forensic computer includes: Monitor WebSocket events of the web page front end; When the WebSocket connection is successfully established, a service notification is sent to the target forensic computer.

5. The method according to claim 1, characterized in that The target forensic computer obtains the target version of the device detection program from the server according to the service notification.

6. The method according to claim 1, characterized in that The server is an intranet server.

7. The method according to claim 1, characterized in that The target version is the latest version.

8. The method according to claim 1, characterized in that The target forensic computer adopts silent startup when starting the device detection program.

Images