Evidence collection method, device and electronic device based on mobile storage device

Abstract

The present invention provides a forensics method, device and electronic device based on a mobile storage device, wherein the mobile storage device includes a system partition and a data partition, and the system partition is installed with professional forensics tools, screen recording tools, user-defined forensics tools and preset operating systems running thereon, so that when the mobile storage device is used on a device to be forensics, the forensics tools in the system partition can be directly run to perform forensics operations, and the mobile storage device supports forensics operations on the device to be forensics in the power-on and power-off states, thereby solving the defects of large limitations on on-site inspections and low forensics efficiency caused by computer inspection and disk disassembly; further, since the mobile storage device also supports customized forensics tools, the user can place various customized forensics tools in the system partition of the mobile storage device, which not only enriches and improves the forensics operations, but also greatly improves the forensics efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic evidence collection, and in particular to an evidence collection method, device and electronic equipment based on a mobile storage device. Background Art

[0002] Computer on-site inspection refers to the process of fixing the computer's operating status and data at the crime scene. Usually, computer on-site inspection includes power-on inspection and power-off inspection. The corresponding power-on inspection operation and power-off inspection operation are performed according to the power-on or power-off status of the computer to extract evidence data.

[0003] The computer on-site inspection method in the related technology must be carried out with the help of inspection tools such as hard disk copiers, read-only interfaces and read-only panels, and during the inspection process, the image file or clone disk containing the evidence data is mainly obtained by disassembling the computer hard disk for mirroring or disassembling the disk for cloning.

[0004] However, the existing computer on-site inspection methods require the use of on-site inspection tools and the removal of the hard disk to obtain evidence. The operation is cumbersome and even difficult to disassemble or damages the body. There are also cases where the inspection cannot be carried out due to the mismatch of the hard disk interface after the disk is removed or the hard disk soldered to the motherboard cannot be removed. As a result, the on-site inspection is greatly limited and the evidence collection efficiency is low. Summary of the invention

[0005] The present invention provides a mobile storage device-based evidence collection method, device and electronic device, which are used to solve the defects of the prior art that the on-site inspection tools and the disk dismantling are required to obtain evidence, resulting in large limitations on on-site inspection and low evidence collection efficiency, and achieve the purpose of on-site evidence collection by calling the evidence collection tools in the customized mobile storage device without dismantling the disk.

[0006] The present invention provides a mobile storage device, comprising: a system partition and a data partition, wherein the system partition is installed with a preset operating system, a screen recording tool, a professional evidence collection tool and a user-defined evidence collection tool; the data partition is used to store evidence collection data, the professional evidence collection tool is used for mirroring or cloning evidence collection, and the user-defined evidence collection tool is used for packet capture or data analysis.

[0007] A mobile storage device provided according to the present invention further includes a read-only lock, which is used to be activated during the use of the mobile storage device to prohibit other operations except read operations from being performed on the forensic data stored in the data partition.

[0008] According to a mobile storage device provided by the present invention, the professional evidence collection tools installed in the system partition include a hard disk image tool, a memory image tool and a hard disk cloning tool, and the user-defined tools include a packet capture tool and a data extraction tool.

[0009] The present invention also provides a method for obtaining evidence based on a mobile storage device, the method comprising:

[0010] Get the evidence collection start instruction;

[0011] Based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data;

[0012] The evidence data is stored.

[0013] According to a mobile storage device-based evidence collection method provided by the present invention, based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data, includes:

[0014] When it is determined that the current state of the device to be evidenced is a powered-on state, based on the evidence collection start instruction, a screen recording tool in the mobile storage device is started to record the screen;

[0015] During the screen recording process, when it is determined that the current state of the device to be evidenced is the power-on state, the memory mirroring tool in the mobile storage device is started to create a memory mirror, thereby obtaining a mirror file containing evidence data.

[0016] According to a mobile storage device-based evidence collection method provided by the present invention, based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data, includes:

[0017] When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

[0018] According to a mobile storage device-based evidence collection method provided by the present invention, based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data, includes:

[0019] When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the evidence collection startup instruction, the preset operating system in the mobile storage device is started to run the hard disk cloning tool to perform a cloning operation, thereby obtaining a clone disk containing evidence data.

[0020] According to a forensics method based on a mobile storage device provided by the present invention, storing the evidence data includes:

[0021] Obtaining current available space information of the data partition;

[0022] When it is determined that the current available space information meets the preset storage condition, the evidence data is stored in the data partition of the mobile storage device.

[0023] According to a forensics method based on a mobile storage device provided by the present invention, after the step of obtaining the current available space information of the data partition, the method further includes:

[0024] When it is determined that the current available space information does not meet the preset storage condition, a first prompt information is output, where the first prompt information is used to prompt the user to store the evidence data in an external hard disk.

[0025] According to a mobile storage device-based evidence collection method provided by the present invention, after the step of obtaining the evidence collection start instruction, the method further includes:

[0026] Obtaining the cumulative usage frequency of the mobile storage device;

[0027] Determine the magnitude relationship between the accumulated usage frequency and a preset usage frequency threshold;

[0028] When it is determined that the accumulated usage frequency does not reach the preset usage frequency threshold, executing the step of invoking a professional evidence collection tool in the mobile storage device to perform an evidence collection operation based on the evidence collection start instruction, thereby obtaining evidence data;

[0029] When it is determined that the accumulated usage frequency reaches the preset usage frequency threshold, a second prompt information is output, where the second prompt information is used to prompt the user to replace the mobile storage device with a new one.

[0030] According to a method for obtaining evidence based on a mobile storage device provided by the present invention, after the step of storing the evidence data, the method further includes:

[0031] Determine whether an auxiliary evidence collection operation instruction is received;

[0032] If the auxiliary evidence collection operation instruction is received, the auxiliary evidence collection operation in the auxiliary operation instruction is parsed and executed, thereby obtaining auxiliary evidence data; wherein the auxiliary evidence collection operation is completed based on a user-defined evidence collection tool;

[0033] If the auxiliary evidence collection operation instruction is not received, the evidence collection operation is terminated.

[0034] The present invention also provides a mobile storage device-based evidence collection device, comprising:

[0035] An acquisition module is used to obtain the forensic startup instruction;

[0036] A forensics module, used to call a professional forensics tool in the mobile storage device to perform a forensics operation based on the forensics startup instruction, thereby obtaining evidence data;

[0037] A storage module is used to store the evidence data.

[0038] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the forensics methods based on mobile storage devices described above are implemented.

[0039] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the forensics methods based on mobile storage devices described above are implemented.

[0040] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the forensics methods based on a mobile storage device as described above are implemented.

[0041] The present invention provides a forensics method, device and electronic device based on a mobile storage device, wherein the mobile storage device includes a system partition and a data partition, and the system partition is installed with professional forensics tools, screen recording tools, user-defined forensics tools and a preset operating system for their operation, so that when the mobile storage device is used on a device to be used for forensics, the forensics tools in the system partition can be directly run to perform forensics operations, and the mobile storage device supports forensics operations on the device to be used for forensics in the power-on and power-off states, thereby solving the defects of large limitations on on-site inspections and low forensics efficiency caused by computer inspection and disk disassembly; further, since the mobile storage device also supports customized forensics tools, users can place various customized forensics tools in the system partition of the mobile storage device, which not only enriches and improves forensics operations, but also greatly improves forensics efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 It is a structural schematic diagram of a mobile storage device provided by the present invention;

[0044] Figure 2 It is a flow chart of the evidence collection method based on mobile storage device provided by the present invention;

[0045] Figure 3 It is a structural schematic diagram of a mobile storage device-based evidence collection device provided by the present invention;

[0046] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] At present, computer on-site inspection is the process of fixing the computer's operating status and data at the scene of the case. Computer on-site inspection is generally divided into shutdown inspection and power-on inspection. The shutdown inspection can directly clone or mirror the computer hard disk, split the disk image or do not need to remove the disk image. The power-on inspection has an additional step of making memory image compared to the shutdown inspection. When conducting a computer on-site inspection, it is generally necessary to use on-site inspection tools such as hard disk copiers, read-only interfaces, and read-only panels to complete it. And it is carried out through hard disk copiers, read-only interfaces, and read-only panels. There are the following defects: 1) On-site inspection requires disk removal for evidence collection, which is troublesome to operate; 2) It is difficult to disassemble a laptop with delicate craftsmanship, and disassembly may damage the body; 3) After the disk is removed, the hard disk interface does not match, resulting in the inability to inspect; 4) In the case where the hard disk is welded on the motherboard, it cannot be disassembled, resulting in the inability to inspect; 5) There is a lack of memory fixing tools, and volatile data cannot be fixed.

[0049] It should be noted that the purpose of on-site investigation is often to obtain evidence. Therefore, the problems encountered during the on-site investigation can also be considered as problems that need to be solved in the evidence collection process.

[0050] Based on the above problems, the present invention provides a method, device and electronic device for obtaining evidence based on a mobile storage device. Figure 1-Figure 4 The invention describes a mobile storage device-based evidence collection method, device and electronic device.

[0051] Figure 1 The mobile storage device provided by the present invention is exemplified, and the mobile storage device has the functions of running an operating system, running various evidence collection tools, and storing data, and supports power-on inspection and power-off inspection. In addition, the present invention does not specifically limit the specific form of the mobile storage device.

[0052] like Figure 1As shown, the mobile storage device includes: a system partition and a data partition, the system partition is installed with a preset operating system, a screen recording tool, a professional forensic tool and a user-defined forensic tool; the data partition is used to store forensic data, the professional forensic tool is used for mirroring or cloning forensics, and the user-defined forensic tool is used for packet capture or data analysis.

[0053] Specifically, the preset operating system may be Windows 7 or Windows 10 operating system, professional evidence collection tools may include hard disk imaging tools, memory imaging tools, hard disk cloning tools and other evidence collection tools, and user-defined evidence collection tools may include packet capture tools, data extraction tools and other tools. For example, professional evidence collection tools and user-defined evidence collection tools and the dependent Windows 7 or Windows 10 operating system may be burned into a mobile storage device to achieve the purpose of performing on-site inspection of the computer by inserting the mobile storage device.

[0054] It should be noted that the mobile storage device can be specifically customized as a USB flash drive, a mobile hard disk, or other similar portable device, and different storage capacities can be set according to the need for evidence collection, for example, a storage capacity of not less than 64G. When the storage capacity of the mobile storage device is 64G, the storage capacity of the system partition is 30G, that is, the storage capacity of the mobile storage device is closely related to the size of the installed preset operating system. In addition, the user-defined tools can also include data recovery tools, USB connection recording tools, browser history tools, log acquisition tools, memory image analysis tools, etc., which can be installed according to user needs and are not specifically limited here.

[0055] Optionally, the mobile storage device also includes a read-only lock, which is used to be activated during the use of the mobile storage device to prohibit other operations other than read operations on the forensic data stored in the data partition, thereby protecting the data from viruses, Trojans or human errors.

[0056] It should be noted that the professional evidence collection tool for making computer hard disk image and memory image can be FTKImager software, and the professional evidence collection software for hard disk cloning can be Winhex software. In addition, when the mobile storage device is customized, it can be partitioned to obtain a system partition and a data partition, and then Windows7 or Windows10 operating system is installed in the system partition. After the operating system is installed, professional evidence collection tools such as FTKImager software, Winhex software and screen recording tools are installed in the system partition, and other user-defined tools such as packet capture tools and data extraction tools are installed. All tools can be stored in the system partition root directory in the form of a tool list. Therefore, the present invention can be applied to industries such as tobacco.

[0057] The mobile storage device provided by the present invention, by combining software and hardware, installs professional evidence collection tools for computer on-site inspection, screen recording tools, user-defined evidence collection tools and preset operating systems running on them in the system partition of the mobile storage device, so that when the mobile storage device is used on the device to be inspected, the evidence collection tools in the system partition can be directly run to perform evidence collection operations, and the mobile storage device supports evidence collection operations on the device to be inspected in the power-on and power-off states, which solves the defects of large on-site inspection limitations and low evidence collection efficiency caused by computer inspection and disk disassembly; further, because the mobile storage device also supports customized evidence collection tools, users can place various customized evidence collection tools in the system partition of the mobile storage device, which not only enriches and improves the evidence collection operations, but also greatly improves the evidence collection efficiency.

[0058] It should be noted that the specific functions of the mobile storage device can be compared with the following method embodiments.

[0059] The present invention also provides a mobile storage device-based evidence collection method, the execution subject of the mobile storage device-based evidence collection method can be a device to be collected that provides a mobile storage device connection port, and the device to be collected can be a personal computer (PC), a portable device, a laptop, a smart phone, a tablet computer, a portable wearable device, and other electronic devices. The present invention does not limit the specific form of the device to be collected.

[0060] It should be noted that the execution subject of the following method embodiment may be part or all of the above-mentioned device to be obtained for evidence. The following method embodiment is described by taking the execution subject as the device to be obtained for evidence as an example.

[0061] Figure 2 The following is a flow chart of a method for obtaining evidence based on a mobile storage device provided by the present invention. Figure 2 As shown, the evidence collection method based on the mobile storage device includes the following steps:

[0062] Step 210: Obtain a forensics start instruction.

[0063] Specifically, the evidence collection device can obtain the evidence collection start instruction based on the user operation, such as when the user inserts the mobile storage device into the device to be collected, the evidence collection start instruction can be generated. For example, when the mobile storage device is a customized USB flash drive, the evidence collection start instruction can be generated when the USB flash drive is inserted into the USB interface of the device to be collected.

[0064] Step 220: Based on the evidence collection start instruction, call the professional evidence collection tool in the mobile storage device to perform the evidence collection operation, so as to obtain evidence data.

[0065] Specifically, when the device to be collected obtains the collection start instruction, it indicates that the mobile storage device has been inserted into the device to be collected. At this time, the device to be collected can directly call the professional collection tool in the mobile storage device to perform the extraction operation for the evidence data in the device to be collected.

[0066] Step 230: Store the evidence data.

[0067] Specifically, when the device to be collected uses a mobile storage device to extract evidence data, it can be stored based on the form of the evidence data. For example, when the evidence data exists in an image file, the image file can be stored in a data partition of the mobile storage device; when the evidence data exists in a clone disk, the clone disk can be stored in the device to be collected or collected and stored by the evidence collector.

[0068] The mobile storage device-based evidence collection method provided by the present invention can execute the evidence collection operation and store the extracted evidence data by calling the professional evidence collection tool in the mobile storage device when the evidence collection device obtains the evidence collection start instruction, thereby realizing on-site evidence collection on the evidence collection device through the customized mobile storage device without dismantling the disk, solving the defects of large on-site inspection limitations and low evidence collection efficiency caused by the need to use on-site inspection tools and dismantle the disk for evidence collection. The operation is simple and the application is wide, which greatly improves the evidence collection efficiency.

[0069] Optionally, step 220 may be implemented specifically through the following process:

[0070] When it is determined that the current state of the device to be collected evidence is the power-on state, based on the evidence collection startup instruction, the screen recording tool in the mobile storage device is started to perform screen recording; during the screen recording process, the memory mirroring tool in the mobile storage device is started to create a memory mirror, thereby obtaining a mirror file containing evidence data.

[0071] Specifically, when performing evidence collection operations on the device to be collected, the current state of the device to be collected can be determined first. When it is determined that the current state of the device to be collected is turned on, the screen recording in the mobile storage device can be started based on the obtained evidence collection start instruction, and during the screen recording process, the memory mirroring tool in the mobile storage device is started to make a memory mirror, so as to accurately copy the evidence data in the evidence memory of the device to be collected to the memory mirror, thereby obtaining an image file containing the evidence data. Since the image file is usually data that can be lost when the power is off, when the image file is extracted, it can be stored in the data partition of the mobile storage device.

[0072] It should be noted that when the current running state of the device to be collected is determined to be turned on, the memory image tool in the mobile storage device is called based on the evidence startup instruction to execute the evidence data extraction process, and the screen recording tool is in a continuous recording state during the entire evidence data extraction process. In addition, the memory image is an accurate copy of the running memory of the device to be collected, and the memory image stores volatile data during the operation of the device to be collected, such as the clipboard number, process PID, encryption container key, WeChat key, etc.

[0073] The evidence collection method based on a mobile storage device provided by the present invention, for the evidence collection operation of the device to be collected when it is turned on, first starts the screen recording tool in the mobile storage device to perform screen recording, and during the screen recording process, further starts the memory mirroring tool in the mobile storage device to produce a memory mirror, thereby obtaining an image file containing evidence data, thereby achieving direct memory mirroring without disassembling the disk, and supporting fixed memory mirroring, thereby improving the evidence collection efficiency of power-on inspection.

[0074] Optionally, step 220 may also be implemented through the following process:

[0075] When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

[0076] Specifically, if the current running state of the device to be collected is the shutdown state, you can also start the screen recording in the mobile storage device first, and during the screen recording process, based on the evidence collection startup instruction, start the preset operating system in the mobile storage device to run the hard disk imaging tool to perform the imaging operation, and copy the data in the evidence hard disk of the device to be collected bit by bit into an image file in the format of DD, E01, AFF, BIN, IMG, Raw, etc., so as to obtain an image file containing the evidence data. The image file can also be stored in the data partition of the mobile storage device.

[0077] It should be noted that when it is determined that the current running state of the device to be collected is the shutdown state, it is necessary to start the preset operating system in the mobile storage device and continue to record the screen during the entire process of running the hard disk image tool in the mobile storage device to perform evidence data extraction. In addition, the hard disk image represents the hard disk to file operation, that is, by copying the data in the evidence hard disk of the device to be collected bit by bit into the image file, the image file is equivalent to the original evidence disk in court, and common image formats include DD, E01, AFF, BIN, IMG, Raw, etc.

[0078] The evidence collection method based on a mobile storage device provided by the present invention aims at the evidence collection operation when the device to be collected is in a shutdown state. The hard disk imaging tool is run by starting a preset operating system in the mobile storage device to perform the imaging operation, thereby obtaining an image file containing evidence data. In this way, the purpose of completing the shutdown inspection directly through the hard disk imaging without disassembling the disk is achieved, thereby improving the evidence collection efficiency of the shutdown inspection.

[0079] Optionally, step 220 may also be implemented through the following process:

[0080] When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the evidence collection startup instruction, the preset operating system in the mobile storage device is started to run the hard disk cloning tool to perform a cloning operation, thereby obtaining a clone disk containing evidence data.

[0081] Specifically, when it is determined that the current operating state of the device to be collected is a shutdown state, the shutdown inspection can also be completed through a cloning operation, that is, based on the evidence collection startup instruction, the preset operating system in the mobile storage device is started to run the hard disk cloning tool to perform a cloning operation, and the data in the evidence hard disk of the device to be collected is copied bit by bit to the clone disk, thereby obtaining a clone disk containing the evidence data.

[0082] It should be noted that when it is determined that the current operating state of the device to be collected is the shutdown state, it is also necessary to start the preset operating system in the mobile storage device and continue to record the screen during the entire process of running the hard disk cloning tool to perform the cloning operation. In addition, the cloning operation represents hard disk to hard disk, that is, by copying the data in the evidence hard disk of the device to be collected bit by bit to the clone disk, the clone disk is equivalent to the original evidence disk in court.

[0083] The evidence collection method based on a mobile storage device provided by the present invention aims at the evidence collection operation when the device to be collected is in a shutdown state. The hard disk cloning tool is run to perform the cloning operation by starting a preset operating system in the mobile storage device, thereby obtaining a clone disk containing evidence data. In this way, the purpose of completing the shutdown inspection directly through hard disk cloning without disassembling the disk is achieved, thereby improving the evidence collection efficiency and flexibility of the shutdown inspection.

[0084] Optionally, the implementation process of step 230 may include:

[0085] Acquire current available space information of the data partition; and when it is determined that the current available space information meets a preset storage condition, store the evidence data in the data partition of the mobile storage device.

[0086] Specifically, for the evidence data obtained by calling the professional forensic tool in the mobile storage device for the device to be collected, when the evidence data exists in the image file, the image file can be stored in the data partition of the mobile storage device. However, in order to ensure the validity of the data storage, the current available space information in the data partition can be obtained first, and then it can be determined whether the current available space information meets the preset storage conditions, such as whether the current available space information is sufficient to store the image file. When it is determined that the current available space information meets the preset storage conditions, the image file containing the evidence data can be stored in the data partition of the mobile storage device.

[0087] The evidence collection method based on a mobile storage device provided by the present invention first obtains the available space information in the data partition of the mobile storage device before storing the image file containing the evidence data, and when it is determined that the available space information meets the preset storage conditions, the operation of storing the image file in the data partition of the mobile storage device is executed, thereby ensuring the storage validity and storage reliability of the evidence data.

[0088] Optionally, after the step of obtaining the current available space information of the data partition, the method further includes:

[0089] When it is determined that the current available space information does not meet the preset storage condition, a first prompt information is output, where the first prompt information is used to prompt the user to store the evidence data in an external hard disk.

[0090] Specifically, before storing the image file containing evidence data in the mobile storage device, if the current available space information in the data partition of the mobile storage device does not meet the preset storage conditions, for example, the current available space information is insufficient to store the image file, the device to be collected can output a first prompt message to prompt the evidence collector to store the image file in the hard disk external to the device to be collected.

[0091] The evidence collection method based on a mobile storage device provided by the present invention stores an image file containing evidence data. If the available space information in the data partition of the mobile storage device does not meet the preset storage conditions, the first prompt information is output to prompt the user to store the evidence data in an external hard disk, thereby improving the flexibility and reliability of storing evidence data.

[0092] Optionally, after step 210, the method may further include:

[0093] Obtain the cumulative usage frequency of the mobile storage device; determine the relationship between the cumulative usage frequency and a preset usage frequency threshold; when it is determined that the cumulative usage frequency has not reached the preset usage frequency threshold, execute the step of calling the professional evidence collection tool in the mobile storage device to perform the evidence collection operation based on the evidence collection start instruction, thereby obtaining evidence data; when it is determined that the cumulative usage frequency has reached the preset usage frequency threshold, output a second prompt information, the second prompt information being used to prompt the user to replace the mobile storage device with a new one.

[0094] The preset usage frequency threshold may be used to characterize the frequency with which the mobile storage device can be normally used for on-site inspection work within its service life.

[0095] Specifically, since a forensic start instruction can be generated when the user inserts a mobile storage device into the device to be obtained, when the device to be obtained obtains the forensic start instruction, the cumulative usage frequency can be first obtained for the inserted mobile storage device, and the cumulative usage frequency can be compared with a preset usage frequency threshold. When it is determined that the cumulative usage frequency does not reach the preset usage frequency threshold, it means that the mobile storage device currently inserted into the device to be obtained is within its service life and can perform the forensic operation again, so it can directly transfer to step 220 to perform the forensic operation; on the contrary, when it is determined that the cumulative usage frequency reaches the preset usage frequency threshold, it means that the mobile storage device currently inserted into the device to be obtained will reach the critical value of its service life and can no longer perform the forensic operation normally. At this time, a second prompt message can be output to prompt the user to replace the newly customized mobile storage device.

[0096] The mobile storage device-based evidence collection method provided by the present invention determines whether to continue using the mobile storage device to perform the evidence collection operation or to prompt the user to replace it with a newly customized mobile storage device to perform the evidence collection operation by obtaining whether the cumulative usage frequency of the mobile storage device has reached a preset usage frequency threshold value when the mobile storage device is inserted into the device to be collected, thereby improving the flexibility, diversity, accuracy and stability of the evidence collection operation.

[0097] Optionally, after step 230, the method may further include:

[0098] Determine whether an auxiliary evidence collection operation instruction is received; if the auxiliary evidence collection operation instruction is received, parse and execute the auxiliary evidence collection operation in the auxiliary operation instruction to obtain auxiliary evidence data; wherein the auxiliary evidence collection operation is completed based on a user-defined evidence collection tool; if the auxiliary evidence collection operation instruction is not received, terminate the evidence collection operation.

[0099] Specifically, according to the different needs of users in the actual evidence collection process, after calling the professional evidence collection tool in the mobile storage device to perform the evidence collection operation, you can also perform corresponding auxiliary evidence collection operations based on the auxiliary operation instructions generated by the user operation. The auxiliary evidence collection operation can call the user-defined evidence collection tool in the system partition of the mobile storage device to execute, such as extracting key data involved in the case from the disk of the device to be collected, and making an encrypted container partition image; you can also perform packet capture operations on the running processes of the device to be collected when it is turned on; in this way, you can obtain more targeted and intuitive target evidence data, and store the target evidence data in the data partition of the mobile storage device.

[0100] It should be noted that since the evidence collection process when the device to be collected is in the powered-on state requires the start of screen recording, if no auxiliary evidence collection operation instruction is received after step 230, the screen recording can be stopped and the evidence collection operation can be ended; conversely, if an auxiliary evidence collection operation instruction is received after step 230, the corresponding auxiliary evidence collection operation can be performed based on the auxiliary evidence collection operation instruction, and the target evidence data or encrypted container partition image and other contents obtained after the auxiliary evidence collection operation is executed can be stored before the screen recording is stopped and the evidence collection operation is ended.

[0101] The mobile storage device-based evidence collection method provided by the present invention stores the evidence data obtained by calling a professional evidence collection tool. The evidence collection device determines whether to terminate the evidence collection operation or continue to perform the auxiliary evidence collection operation for the auxiliary evidence collection operation instruction by judging whether an auxiliary evidence collection operation instruction is received, thereby improving the diversity and reliability of the evidence data.

[0102] The following is a description of the evidence collection device based on a mobile storage device provided by the present invention. The evidence collection device based on a mobile storage device described below and the evidence collection method based on a mobile storage device described above can be referenced to each other.

[0103] like Figure 3 As shown, the present invention provides a forensic device based on a mobile storage device. Figure 3 In the example, the evidence collection device 300 based on the mobile storage device includes:

[0104] The acquisition module 310 is used to obtain the evidence start instruction; the evidence module 320 is used to call the professional evidence tool in the mobile storage device to perform the evidence operation based on the evidence start instruction, so as to obtain the evidence data; the storage module 330 is used to store the evidence data.

[0105] Optionally, the evidence collection module 320 can be specifically used to start the screen recording tool in the mobile storage device to perform screen recording based on the evidence collection startup instruction when it is determined that the current state of the device to be collected is the power-on state; during the screen recording process, start the memory mirroring tool in the mobile storage device to create a memory mirror, thereby obtaining a mirror file containing evidence data.

[0106] Optionally, the evidence collection module 320 can be specifically used to start a preset operating system in the mobile storage device based on the evidence collection startup instruction when it is determined that the current state of the device to be collected is a shutdown state, so as to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

[0107] Optionally, the evidence collection module 320 can also be used to start a preset operating system in the mobile storage device based on the evidence collection startup instruction when it is determined that the current state of the device to be collected is a shutdown state, so as to run the hard disk cloning tool to perform a cloning operation, thereby obtaining a clone disk containing evidence data.

[0108] The storage module 330 may be specifically used to obtain the current available space information of the data partition; when it is determined that the current available space information meets the preset storage condition, the evidence data is stored in the data partition of the mobile storage device.

[0109] The storage module 330 may be specifically configured to output a first prompt message when it is determined that the current available space information does not satisfy the preset storage condition, wherein the first prompt message is configured to prompt the user to store the evidence data in an external hard disk.

[0110] Optionally, the evidence collection module 320 can also be used to obtain the cumulative usage frequency of the mobile storage device; determine the relationship between the cumulative usage frequency and a preset usage frequency threshold; when it is determined that the cumulative usage frequency has not reached the preset usage frequency threshold, execute the step of calling the professional evidence collection tool in the mobile storage device to perform the evidence collection operation based on the evidence collection startup instruction, thereby obtaining evidence data; when it is determined that the cumulative usage frequency has reached the preset usage frequency threshold, output a second prompt information, and the second prompt information is used to prompt the user to replace the mobile storage device with a new one.

[0111] Optionally, the evidence collection module 320 can also be used to determine whether an auxiliary evidence collection operation instruction is received; if the auxiliary evidence collection operation instruction is received, the auxiliary evidence collection operation in the auxiliary operation instruction is parsed and executed to obtain auxiliary evidence data; wherein, the auxiliary evidence collection operation is completed based on a user-defined evidence collection tool; if the auxiliary evidence collection operation instruction is not received, the evidence collection operation is terminated.

[0112] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device 400 may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the evidence collection method based on the mobile storage device, and the method includes:

[0113] Get the evidence collection start instruction;

[0114] Based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data;

[0115] The evidence data is stored.

[0116] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0117] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the forensics method based on a mobile storage device provided by the above methods, the method includes:

[0118] Get the evidence collection start instruction;

[0119] Based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data;

[0120] The evidence data is stored.

[0121] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for obtaining evidence based on a mobile storage device provided by the above methods is implemented, and the method comprises:

[0122] Get the evidence collection start instruction;

[0123] Based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data;

[0124] The evidence data is stored.

[0125] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A mobile storage device, characterized in that: include: System partition and data partition, the system partition is installed with a preset operating system, screen recording tool, professional forensic tool and user-defined forensic tool; the data partition is used to store forensic data, the professional forensic tool is used for mirroring or cloning forensics, and the user-defined forensic tool is used for packet capture or data analysis; The professional evidence collection tool is used to perform the evidence collection operation when the device to be collected obtains the evidence collection start instruction, thereby obtaining the evidence data and storing the evidence data; The user-defined evidence collection tool is used to parse and execute the auxiliary evidence collection operation in the auxiliary evidence collection operation instruction if the device to be collected receives the auxiliary evidence collection operation instruction, so as to obtain auxiliary evidence data, and terminate the evidence collection operation if the device to be collected does not receive the auxiliary evidence collection operation instruction; The professional evidence collection tools are specifically used for: When it is determined that the current state of the device to be collected evidence is the power-on state, based on the evidence collection start instruction, the screen recording tool in the mobile storage device is started to record the screen; during the screen recording process, the memory mirroring tool in the mobile storage device is started to create a memory mirror, thereby obtaining a mirror file containing evidence data; When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

2. The mobile storage device according to claim 1, characterized in that: It also includes a read-only lock, which is used to be activated during the use of the mobile storage device to prohibit other operations except read operations from being performed on the forensic data stored in the data partition.

3. The mobile storage device according to claim 1, characterized in that: The professional evidence collection tools installed in the system partition include hard disk imaging tools, memory imaging tools and hard disk cloning tools, and the user-defined evidence collection tools include packet capture tools and data extraction tools.

4. A forensics method based on a mobile storage device, characterized in that: Applied to the mobile storage device according to any one of claims 1 to 3, the method comprises: Get the evidence collection start instruction; Based on the evidence collection start instruction, calling a professional evidence collection tool in the mobile storage device to perform an evidence collection operation, thereby obtaining evidence data; storing the evidence data; After the step of storing the evidence data, the method further comprises: Determine whether an auxiliary evidence collection operation instruction is received; If the auxiliary evidence collection operation instruction is received, the auxiliary evidence collection operation in the auxiliary evidence collection operation instruction is parsed and executed, thereby obtaining auxiliary evidence data; wherein the auxiliary evidence collection operation is completed based on a user-defined evidence collection tool; If the auxiliary evidence collection operation instruction is not received, the evidence collection operation is terminated; Based on the evidence collection start instruction, calling the professional evidence collection tool in the mobile storage device to perform the evidence collection operation, thereby obtaining evidence data, includes: When it is determined that the current state of the device to be collected evidence is the power-on state, based on the evidence collection start instruction, the screen recording tool in the mobile storage device is started to record the screen; during the screen recording process, the memory mirroring tool in the mobile storage device is started to create a memory mirror, thereby obtaining a mirror file containing evidence data; When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

5. The evidence collection method based on mobile storage device according to claim 4 is characterized in that: Based on the evidence collection start instruction, calling the professional evidence collection tool in the mobile storage device to perform the evidence collection operation, thereby obtaining evidence data, includes: When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk cloning tool to perform the cloning operation, thereby obtaining a clone disk containing evidence data.

6. The evidence collection method based on mobile storage device according to claim 4 is characterized in that: The storing of the evidence data comprises: Obtaining current available space information of the data partition; When it is determined that the current available space information meets the preset storage condition, the evidence data is stored in the data partition of the mobile storage device.

7. The evidence collection method based on mobile storage device according to claim 6 is characterized in that: After the step of obtaining the current available space information of the data partition, the method further includes: When it is determined that the current available space information does not meet the preset storage condition, a first prompt information is output, where the first prompt information is used to prompt the user to store the evidence data in an external hard disk.

8. The evidence collection method based on mobile storage device according to claim 4 is characterized in that: After the step of obtaining the evidence collection start instruction, the method further includes: Obtaining the cumulative usage frequency of the mobile storage device; Determine the magnitude relationship between the accumulated usage frequency and a preset usage frequency threshold; When it is determined that the accumulated usage frequency does not reach the preset usage frequency threshold, executing the step of invoking the professional evidence collection tool in the mobile storage device to perform an evidence collection operation based on the evidence collection start instruction, thereby obtaining evidence data; When it is determined that the accumulated usage frequency reaches the preset usage frequency threshold, a second prompt information is output, where the second prompt information is used to prompt the user to replace the mobile storage device with a new one.

9. A forensics device based on a mobile storage device, characterized in that: The device comprises: An acquisition module is used to obtain the forensic startup instruction; A forensics module, used to call a professional forensics tool in the mobile storage device to perform a forensics operation based on the forensics startup instruction, thereby obtaining evidence data; A storage module, used for storing the evidence data; The evidence collection module can also be specifically used to determine whether an auxiliary evidence collection operation instruction is received; if the auxiliary evidence collection operation instruction is received, the auxiliary evidence collection operation in the auxiliary evidence collection operation instruction is parsed and executed, thereby obtaining auxiliary evidence data; wherein the auxiliary evidence collection operation is completed based on a user-defined evidence collection tool; if the auxiliary evidence collection operation instruction is not received, the evidence collection operation is terminated; The evidence collection module can also be specifically used to start the screen recording tool in the mobile storage device to record the screen based on the evidence collection start instruction when it is determined that the current state of the device to be collected is the power-on state; during the screen recording process, start the memory mirroring tool in the mobile storage device to create a memory mirror, thereby obtaining a mirror file containing evidence data; When it is determined that the current state of the device to be collected evidence is a shutdown state, based on the collection start instruction, the preset operating system in the mobile storage device is started to run the hard disk imaging tool to perform the imaging operation, thereby obtaining an image file containing evidence data.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the forensics method based on a mobile storage device as described in any one of claims 4 to 8 are implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the forensics method based on a mobile storage device as claimed in any one of claims 4 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the forensics method based on a mobile storage device as claimed in any one of claims 4 to 8 are implemented.

Images