Data acquisition method and device of application program, computer device and storage medium

Abstract

The application relates to a data acquisition method and device of an application program, a computer device and a storage medium. The method comprises the following steps: identifying a backup application program in an extraction device, establishing a communication response with the backup application program, acquiring a first backup protocol, the first backup protocol being a backup protocol of a target application program in the extraction device, sending the first backup protocol to the backup application program based on the communication response, establishing a first protocol response with the backup application program according to the first backup protocol, and extracting electronic data in the target application program according to the first protocol response. According to the method, electronic data of an application program on a device can be automatically extracted without using different backup tools for different types of devices.

Description

Technical Field

[0001] This application relates to the field of electronic data extraction technology, and in particular to a data acquisition method, apparatus, computer device, and storage medium for an application. Background Technology

[0002] Currently, different brands and types of devices have different operating systems and kernels, resulting in multiple backup versions of applications. Consequently, different brands and types of devices require different official backup tools. Furthermore, even within the same brand and type of device, the operating system and kernel are constantly being updated and upgraded, leading to multiple backup versions of the same application even on the same brand and type of device. Therefore, different brands and types of devices also require multiple backup tools. Take mobile phones as an example:

[0003] For Android phones, there are numerous brands, and their operating systems and kernels are constantly being updated and upgraded, resulting in a multitude of backup app (application) versions. Taking Huawei phones as an example, the evolution of Huawei brand phone systems, PC (personal computer) assistants, and backup versions is as follows:

[0004] 1. Huawei's mobile phone operating system has evolved from Android 6 and EMUI 4.0 to Android 10 and EMUI 10; and then to the domestic system HarmonyOS 2.0 and EMUI 11.

[0005] 2. Huawei phones have more than 8 versions of PC Assistant, ranging from HiSuite_8.0.1.306 to HiSuite_11.0.0.360.

[0006] 3. Huawei Assistant on Huawei phones has more than 10 versions, from HiSuite 8.0.1.305.apk to HiSuite 11.0.0.360.apk.

[0007] 4. Huawei Backup for Huawei phones has more than 10 versions, ranging from KoBackup 8.0.1.301.apk to KoBackup 10.1.1.610.apk.

[0008] 5. After Huawei's mobile phone operating system moved towards the domestically produced HarmonyOS, the Huawei backup on the mobile phone has gone through more than 5 versions, from LocalBackup11.0.0.330.apk to LocalBackup11.0.1.320.apk.

[0009] Therefore, when it is necessary to back up electronic data for applications on one or more devices, the limited backup tools available make the data backup process cumbersome. Summary of the Invention

[0010] Therefore, it is necessary to provide a method, apparatus, computer device, and storage medium for automatically extracting electronic data of applications on devices without requiring different backup tools for different types of devices, in order to address the aforementioned technical problems.

[0011] A method for acquiring data from an application includes: identifying a backup application in a device to be extracted; establishing a communication response with the backup application; acquiring a first backup protocol, wherein the first backup protocol is a backup protocol for a target application in the device to be extracted; sending the first backup protocol to the backup application based on the communication response; establishing a first protocol response with the backup application according to the first backup protocol; and extracting electronic data from the target application according to the first protocol response.

[0012] In one embodiment, establishing a communication response with the backup application includes: obtaining a second backup protocol, wherein the second backup protocol is the backup protocol of the backup application; sending a backup request to the backup application according to the second backup protocol, wherein the backup application returns handshake protocol information upon receiving the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application according to the second backup protocol and the handshake protocol information; and establishing a communication response with the backup application according to the second protocol response.

[0013] In one embodiment, sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information includes: parsing the key and initialization vector iv in the handshake protocol information; sending a second protocol response containing the key and initialization vector iv to the backup application according to the second backup protocol; the backup application verifying the second protocol response based on the key and initialization vector iv and feeding back information indicating that the second protocol response has been verified when the verification is successful; and establishing a communication response with the backup application according to the second protocol response when the information indicating that the second protocol response has been verified is received.

[0014] In one embodiment, a data acquisition method for an application further includes: obtaining a necessary protocol from a second backup protocol according to preset filtering conditions, wherein the necessary protocol is a protocol used to back up the electronic data of the target application; and generating a first backup protocol according to the necessary protocol.

[0015] In one embodiment, a data acquisition method for an application further includes: identifying the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; identifying the version of the backup application based on the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; and obtaining a second backup protocol based on the version of the backup application.

[0016] In one embodiment, a data acquisition method for an application further includes: detecting whether a first obstacle and a second obstacle exist in the device to be extracted, wherein the first obstacle is a factor that prevents the extraction of electronic data from the device to be extracted, and the second obstacle is a factor that prevents the authorization of data backup from the device to be extracted; if the first obstacle exists, obtaining a first processing scheme for the first obstacle, and processing the device to be extracted according to the first processing scheme to enable the extraction of electronic data in the target application according to a first protocol response; if the second obstacle exists, obtaining a second processing scheme for the second obstacle, and processing the device to be extracted according to the second processing scheme to obtain data backup permission for the device to be extracted, thereby enabling the extraction of electronic data in the target application according to a first protocol response.

[0017] In one embodiment, a data acquisition method for an application further includes: acquiring extracted electronic data; decrypting the extracted electronic data to obtain user data of the target application; and parsing the user data to obtain deleted electronic data in the target application.

[0018] An application data acquisition device includes: a first establishment module for identifying a backup application in a device to be extracted and establishing a communication response with the backup application; an acquisition module for acquiring a first backup protocol, wherein the first backup protocol is a backup protocol of a target application in the device to be extracted; a sending module for sending the first backup protocol to the backup application based on the communication response; a second establishment module for establishing a first protocol response with the backup application according to the first backup protocol; and an extraction module for extracting electronic data from the target application according to the first protocol response.

[0019] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the methods described above.

[0020] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0021] The aforementioned data acquisition method, apparatus, computer equipment, and storage medium for the application identify a backup application in the device to be extracted; establish a communication response with the backup application; acquire a first backup protocol, which is the backup protocol of the target application in the device to be extracted; send the first backup protocol to the backup application based on the communication response; establish a first protocol response with the backup application according to the first backup protocol; and extract electronic data from the target application based on the first protocol response. Therefore, it can automatically extract electronic data of applications in the device to be extracted without using specific data backup tools for the device, and the operation is simple. Attached Figure Description

[0022] Figure 1 This is an application environment diagram of a data acquisition method for an application in one embodiment.

[0023] Figure 2 This is a flowchart illustrating a data acquisition method for an application in one embodiment;

[0024] Figure 3 This is a diagram illustrating the information interaction between a data extraction device and a backup application in one embodiment;

[0025] Figure 4 This is a schematic diagram illustrating the process of a professional data collection device collecting mobile phone information and APP information in a specific embodiment.

[0026] Figure 5 for Figure 4 The embodiment is a schematic diagram of the communication connection and interaction between the professional data acquisition equipment and the mobile phone;

[0027] Figure 6 This is a structural block diagram of a data acquisition device for an application in one embodiment;

[0028] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] This application provides a data acquisition method for applications such as... Figure 1 The application environment shown. For example... Figure 1As shown, the data extraction device 104 is used to implement a data acquisition method for an application according to this application. Specifically, the data extraction device 104 identifies a backup application in the device 102 to be extracted and establishes a communication response with the backup application. The data extraction device 104 acquires a first backup protocol, which is the backup protocol of the target application in the device 102 to be extracted. Based on the communication response, the data extraction device 104 sends the first backup protocol to the backup application, establishes a first protocol response with the backup application according to the first backup protocol, and extracts electronic data from the target application according to the first protocol response. The device 102 to be extracted may be a data device involved in a case, such as a mobile phone or tablet computer. The data extraction device 104 may be an evidence collection device used to collect evidence and extract electronic data related to crimes such as destruction, fraud, and attack from the data device involved in a case.

[0031] In one embodiment, such as Figure 2 As shown, a data acquisition method for an application is provided, which is applied to... Figure 1 Taking the data extraction device 104 as an example, the following steps are included:

[0032] S202, identify the backup application in the device to be extracted, and establish a communication response with the backup application.

[0033] In this embodiment, the device to be extracted can be a mobile terminal device, such as a mobile phone or tablet computer. Figure 3 As shown, the device to be extracted has a backup application installed. This backup application is used to back up data on the device. For example, if the device is a Huawei phone, the backup application could be a mobile assistant installed on the Huawei phone. When the data extraction device connects to the device, it collects the device's access information, filters the application package information of the backup application from the access information, and then identifies the backup application. The data extraction device stores the official backup protocol of the backup application and establishes a communication response with the backup application based on the official backup protocol.

[0034] S204, Obtain the first backup protocol, which is the backup protocol of the target application in the device to be extracted.

[0035] In this embodiment, the first backup protocol is the backup protocol for the target application in the device to be extracted. This refers to the use of the first backup protocol when backing up data from the target application. Specifically, the first backup protocol is pre-configured based on the target application. This can be based on the data type and extraction method of the electronic data to be extracted from the target application. For example, if the target application is WeChat, and the data type of the electronic data to be extracted from WeChat is document, image, or text, the first backup protocol is configured according to the document, image, or text data in WeChat, and the extraction method for that data.

[0036] S206, based on the communication response, sends the first backup protocol to the backup application.

[0037] In this embodiment, as Figure 3 As shown, after establishing a communication response with the backup application, a first backup protocol is sent to the backup application based on the communication response. The backup application receives the first backup protocol and responds to it.

[0038] S208, establish a first protocol response with the backup application according to the first backup protocol.

[0039] In this embodiment, as Figure 3 As shown, the data extraction device sends a first backup protocol to the backup application, and the backup application responds to the first backup protocol by sending a response reply to the device to be extracted. When the data extraction device receives the response reply, it establishes a first protocol response with the backup application.

[0040] S210, extract electronic data from the target application according to the first protocol response.

[0041] In this embodiment, as Figure 3 As shown, the data extraction device establishes a first protocol response with the backup application, and exchanges information with the backup application through the first protocol response. The first backup protocol used to construct the first protocol response is the backup protocol of the target application in the device to be extracted. Therefore, the backup application can obtain the electronic data of the target application from the device to be extracted based on the first protocol response, and then feed back the electronic data of the target application to the data extraction device through the first protocol response, thereby realizing the extraction of the electronic data of the target application.

[0042] The aforementioned data acquisition method, apparatus, computer equipment, and storage medium for the application identify a backup application in the device to be extracted; establish a communication response with the backup application; acquire a first backup protocol, which is the backup protocol of the target application in the device to be extracted; send the first backup protocol to the backup application based on the communication response; establish a first protocol response with the backup application according to the first backup protocol; and extract electronic data from the target application based on the first protocol response. Therefore, it can automatically extract electronic data of applications in the device to be extracted without using specific data backup tools for the device, and the operation is simple.

[0043] In one embodiment, the above-mentioned communication response with the backup application includes: obtaining a second backup protocol, wherein the second backup protocol is the backup protocol of the backup application; sending a backup request to the backup application according to the second backup protocol, wherein the backup application returns handshake protocol information when it receives the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application according to the second backup protocol and the handshake protocol information; and establishing a communication response with the backup application according to the second protocol response.

[0044] In this embodiment, the data extraction device stores a second backup protocol for the backup application. For example, if the backup application is Huawei Assistant, then the second backup protocol is Huawei Assistant's backup protocol. The data extraction device determines the second backup protocol based on the collected operating system information, kernel system information, and version information of the backup application from the device to be extracted, and sends a backup request to the backup application through the second backup protocol. The backup application verifies the legality of the second backup request, such as verifying whether the second backup request is initiated by the official backup protocol. If the verification is successful, it returns handshake protocol information to the data extraction device. The data extraction device sends a second protocol response to the backup application based on the second backup protocol and the handshake protocol information. The second protocol response is a handshake protocol response. The backup application receives the second protocol response and establishes a communication response with the data extraction device. The backup application and the data extraction device can interact based on the communication response.

[0045] Specifically, sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information includes: identifying the application package of the backup application through the View Device command of the Android Debug Bridge or the Package Manager command in the Login Device command of the Android Debug Bridge; conducting handshake communication with the application package of the backup application through a socket according to the handshake protocol information; and sending a second protocol response to the backup application according to the second backup protocol and based on the handshake communication.

[0046] In this embodiment, the data extraction device uses commands such as `adb devices` and `adb shell pm` to identify the application package of the backup application. It then establishes a handshake with the backup application's application package via a socket. The APK (Android application package) on the device to be extracted is verified, thus establishing network communication between the device to be extracted and the data extraction device. A second protocol response is then sent to the backup application based on the second backup protocol and the handshake communication.

[0047] In one embodiment, sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information includes: parsing the key and initialization vector iv in the handshake protocol information; sending a second protocol response containing the key and initialization vector iv to the backup application according to the second backup protocol; the backup application verifying the second protocol response based on the key and initialization vector iv and feeding back information indicating that the second protocol response has been verified when the verification is successful; and establishing a communication response with the backup application based on the second protocol response when the information indicating that the second protocol response has been verified is received.

[0048] In this embodiment, the handshake protocol information is decrypted, and the key and initialization vector (IV) are extracted from it. A second protocol response containing the key and IV is then sent according to the second backup protocol. The second protocol response can be a handshake protocol response. Upon receiving the handshake protocol response, the backup application extracts the key and IV and verifies the legitimacy of the handshake protocol response based on them, such as verifying whether the response is an official backup protocol response. If the verification is successful, the backup application returns a handshake confirmation. Then, the backup application establishes a communication response with the data extraction device.

[0049] In one embodiment, before the step of obtaining the first backup protocol, the method further includes: obtaining a necessary protocol from the second backup protocol according to preset filtering conditions, wherein the necessary protocol is the protocol used by the electronic data of the backup target application; and generating the first backup protocol according to the necessary protocol.

[0050] In this embodiment, the first backup protocol is obtained by filtering the second backup protocol. The second backup protocol is a backup protocol for the backup application, containing multiple protocols, to which the backup application responds. Specifically, filtering conditions are pre-set based on the electronic data to be extracted from the target application, and necessary protocols are obtained from the second backup protocol according to these conditions. For example, if the electronic data to be extracted from the target application is a document, image, or text, filtering conditions for documents, images, or text are set. One or more protocols are obtained from the second backup protocol based on these filtering conditions, and these one or more protocols constitute the aforementioned necessary protocols. Necessary protocols refer to those used when backing up electronic data of the target application. Then, the first backup protocol is generated based on the filtered necessary protocols. Alternatively, the necessary protocols can be encapsulated according to the protocol format of the second backup protocol to obtain the first backup protocol.

[0051] In one embodiment, prior to obtaining the second backup protocol, the method further includes: identifying the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; identifying the version of the backup application based on the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; and obtaining the second backup protocol based on the version of the backup application.

[0052] In this embodiment, the version of the backup application is identified based on the brand of the device to be extracted, its operating system, and the backup application. For example, if the device to be extracted is a Huawei Mate40-Pro, its operating system is Huawei's HarmonyOS, and the backup application is Huawei Mobile Assistant, then the backup version of Huawei Mobile Assistant can be determined, and consequently, the backup protocol of the Mobile Assistant on the Huawei phone can be determined. Since different backup versions correspond to different backup protocols, the second backup protocol can be accurately obtained based on the version of the backup application.

[0053] The process of identifying the brand, operating system, and backup application of the device to be extracted can be achieved by using `adb devices` and `adb shell pm` to obtain the brand identification information, operating system information, and package name of the backup application of the device to be extracted. The brand of the device to be extracted is identified based on the brand identification information, the operating system of the device to be extracted is identified based on the operating system information, and the backup application is identified based on the package name of the backup application.

[0054] In one embodiment, identifying the backup application in the device to be extracted and establishing a communication response with the backup application includes: identifying the package name of the backup application, identifying the backup application based on the package name of the backup application, starting the backup service of the backup application based on the package name of the backup application, and establishing a communication response with the backup application based on the backup service.

[0055] In this embodiment, the package name of the backup application in the device to be extracted is identified, and the backup service of the backup application on the device to be extracted is started using `adb shell amstart -n apk package name / apk package name.activity name`. A communication response is established between the backup service and the backup application to perform electronic data backup of the backup application. Therefore, technical support is provided for achieving automated data extraction of the target application.

[0056] In one embodiment, before the step of identifying the backup application in the device to be extracted, the method further includes: identifying the capacity of the available space of the device to be extracted; if the capacity of the available space is less than a preset capacity, generating a capacity prompt message.

[0057] In this embodiment, after connecting to the device to be extracted, the `adb shell df` command is used to identify the available space capacity of the device. If the available space capacity is less than a preset capacity, it is identified that the available space of the device to be extracted is insufficient, and a capacity reminder message is generated to notify the user. Therefore, a capacity reminder function can be implemented.

[0058] In one embodiment, after the step of identifying the backup application in the device to be extracted, the method further includes: detecting whether there is a first obstacle and a second obstacle in the device to be extracted, wherein the first obstacle is a factor that hinders the extraction of electronic data from the device to be extracted, and the second obstacle is a factor that hinders the authorization of data backup of the device to be extracted; if there is a first obstacle, obtaining a first processing solution for the first obstacle, and processing the device to be extracted according to the first processing solution so as to be able to respond to the extraction of electronic data in the application according to the first protocol; if there is a second obstacle, obtaining a second processing solution for the second obstacle, and processing the device to be extracted according to the second processing solution so as to obtain the data backup permission of the device to be extracted, thereby enabling the device to respond to the extraction of electronic data in the application according to the first protocol.

[0059] In this embodiment, after identifying the backup application in the device to be extracted, the factors hindering electronic data backup and the backup authorization status in the device to be extracted are identified, and corresponding processing is performed automatically. Specifically, the data extraction device has corresponding processing schemes based on the possible obstacles to electronic data backup. If an obstacle to electronic data backup occurs, the data corresponding to the obstacle is collected, the data is analyzed and processed to determine the corresponding obstacle, and then a corresponding processing scheme is determined based on the obstacle. The corresponding processing scheme is used to solve the obstacle to electronic data backup, thereby enabling the extraction of electronic data from the target application. For example, it detects whether there is a first obstacle to electronic data extraction and a second obstacle to data backup authorization in the device to be extracted. The detection method includes: during the electronic data extraction process of the target application in the device to be extracted, when electronic data extraction failure is identified, relevant data of electronic data extraction failure is collected, the relevant data is analyzed, and the first obstacle and / or the second obstacle is determined. If a first obstacle exists, a first processing solution for the first obstacle is obtained, and the device to be extracted is processed accordingly according to the first processing solution to enable the extraction of electronic data from the target application according to the first protocol response. If a second obstacle exists, a second processing solution for the second obstacle is obtained, and the device to be extracted is processed accordingly according to the second processing solution to obtain data backup permissions for the device to be extracted, thereby enabling the extraction of electronic data from the target application on the device to be extracted. Therefore, during the electronic data acquisition process, a series of issues involving obstacles to electronic data backup and authorization can be automatically handled.

[0060] In one embodiment, after the step of extracting electronic data from the target application according to the first protocol response, the method further includes: obtaining the extracted electronic data; decrypting the extracted electronic data to obtain user data of the target application; and parsing the user data to obtain deleted electronic data in the target application.

[0061] In this embodiment, the extracted electronic data is compressed and encrypted. The data extraction device decrypts and decompresses the electronic data to obtain the user data of the target application. Then, it parses the electronic data to identify deleted electronic data within the target application, thus recovering the deleted electronic data. For example, the data extraction device is a PC. The PC uses extraction, decryption, and decompression techniques to process the electronic data, thereby extracting the deleted electronic data from the target application. Specifically, the user data of the target application is backed up, extracted to the PC using BusyBox, decrypted using a decryption algorithm, and finally decompressed using 7z or tar compression techniques. Further, the user data of the target application is parsed, and the deleted electronic data is extracted. BusyBox is a software that integrates over 300 of the most commonly used Linux commands and tools. Therefore, deleted electronic data from the application can be recovered.

[0062] In one embodiment, after the step of obtaining the deleted electronic data in the target application, the method further includes: displaying user data containing the deleted electronic data in a data presentation, and / or sending the user data to the user of the relevant user account in the form of a data report.

[0063] In this embodiment, after the electronic data backup of the target application is completed, the user data is displayed and / or uploaded to the corresponding user account. For example, the parsed electronic data of the target application is displayed. The parsed electronic data of the target application is uploaded to the user account in the form of a data report.

[0064] This application discloses a method for acquiring application data. It can automatically identify a mobile phone and automatically select the backup version corresponding to the backup application's APK on the phone. Then, based on the backup version of the backup application, it uses the backup application to extract data from the target application. Furthermore, it can automatically identify and handle factors on the phone that hinder electronic data backup, such as disabling cloud backup. It automatically identifies the phone's electronic data backup authorization and automatically enables backup authorization if it is not enabled. It automatically identifies the system clone of the target application on the phone and automatically backs up the electronic data in the target application's system clone. Additionally, it can automatically back up user data from the target application when it is very large. It can also automatically back up contact data in the phone's system, enabling the recovery of more deleted contact data.

[0065] In one embodiment, the data acquisition method of this application is applied to the PC side of a professional data acquisition device. The PC side uses the application's data acquisition method to extract electronic data from the mobile phone, where the device to be extracted is a mobile phone. The following explanation uses a Huawei mobile phone as an example:

[0066] Phone: Huawei nova 7 (8GB / 128GB / 5G version / Full Netcom) Specifications #CPU: Hisilicon Kirin 985 #Operating System: EMUI 10.1 (based on Android 10).

[0067] Example of electronic data collection process on mobile phones:

[0068] 1. The Huawei nova 7 connects to a professional data acquisition device, which executes one of the data acquisition methods described above. The professional data acquisition device immediately captures the phone's connection information and displays the phone information in the data acquisition wizard interface using tools such as adb devices.

[0069] 2. In the data collection wizard interface, the user clicks "Collect Electronic Data from Huawei Mobile Phone". The user selects to collect basic information of the mobile phone and APP information, and the default is to collect all information.

[0070] 3. The user continues by clicking Next. For the process of professional data collection equipment collecting mobile phone and app information, please refer to [link / reference needed]. Figure 4 As shown. The communication connection process between the professional acquisition equipment and the mobile phone during the acquisition process is detailed in [reference needed]. Figure 5 As shown. Professional data acquisition equipment uses... Figure 4 process and Figure 5 The system automatically collects mobile phone information via communication connection and displays a progress bar in the collection wizard interface indicating that mobile phone and APP information is being collected. It automatically backs up the electronic data of the APP, extracts the backed-up electronic data to the PC of the professional collection device, and decrypts, decompresses, and parses the APP information until all mobile phone and APP information has been collected.

[0071] 4. Once the mobile phone information and APP information collection is complete, the professional collection equipment provides a professional interface to display the Huawei nova 7's contact list, call logs, SMS messages, QQ, WeChat and other APP information.

[0072] Therefore, when the application data acquisition method of this application is applied to the electronic data collection of mobile phones during police investigations, the electronic data of the APP on the mobile phone can be obtained through protocol simulation technology. This greatly assists investigators in extracting information from the suspect's APP, simplifies the collection process, automatically handles a series of problems that arise during the collection process, and enables ordinary police officers at the grassroots level to extract APP data from the suspect's mobile phone. This application automates the acquisition of APP data through protocol simulation technology, while the official mobile phone technology needs to consider the mobile phone system and kernel system, and also needs to select the corresponding PC assistant and backup application APK version. The automatic processing technology features of the application data acquisition method of this application are as follows:

[0073] 1. Connect to your mobile phone, select the app to collect data, and the entire data collection process can be automated when encountering issues such as backup obstacles and authorization problems.

[0074] 2. During the APP backup and data collection process, the system automatically initiates and completes backups. It can also perform data processing such as extraction, decryption, decompression, and parsing of APP data. In addition, it can automatically extract deleted electronic data from the APP.

[0075] 3. After the process of collecting electronic data from the APP is completed, ordinary police officers at the grassroots level can view the APP information on the suspect's mobile phone through the data collection wizard interface.

[0076] It should be understood that although the steps in the flowchart are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the accompanying drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0077] This application also provides a data acquisition device for an application, such as... Figure 6As shown, the device includes a first establishment module 602, an acquisition module 604, a sending module 606, a second establishment module 608, and an extraction module 610. The first establishment module 602 is used to identify the backup application in the device to be extracted and establish a communication response with the backup application; the acquisition module 604 is used to acquire a first backup protocol, which is the backup protocol of the target application in the device to be extracted; the sending module 606 is used to send the first backup protocol to the backup application based on the communication response; the second establishment module 608 is used to establish a first protocol response with the backup application according to the first backup protocol; and the extraction module 610 is used to extract electronic data from the target application according to the first protocol response.

[0078] In one embodiment, establishing a communication response with the backup application includes: obtaining a second backup protocol, wherein the second backup protocol is the backup protocol of the backup application; sending a backup request to the backup application according to the second backup protocol, wherein the backup application returns handshake protocol information upon receiving the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application according to the second backup protocol and the handshake protocol information; and establishing a communication response with the backup application according to the second protocol response.

[0079] In one embodiment, sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information includes: parsing the key and initialization vector iv in the handshake protocol information; sending a second protocol response containing the key and initialization vector iv to the backup application according to the second backup protocol; the backup application verifying the second protocol response based on the key and initialization vector iv and feeding back information indicating that the second protocol response has been verified when the verification is successful; and establishing a communication response with the backup application according to the second protocol response when the information indicating that the second protocol response has been verified is received.

[0080] In one embodiment, an application data acquisition device further includes a generation module, configured to acquire necessary protocols from a second backup protocol according to preset filtering conditions, wherein the necessary protocols are protocols used to back up the electronic data of the target application; and generate a first backup protocol according to the necessary protocols.

[0081] In one embodiment, an application data acquisition device further includes an acquisition module for identifying the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; identifying the version of the backup application based on the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; and acquiring a second backup protocol based on the version of the backup application.

[0082] In one embodiment, an application data acquisition device further includes a processing module for detecting whether a first obstacle and a second obstacle exist in the device to be extracted. The first obstacle is a factor that hinders the extraction of electronic data from the device to be extracted, and the second obstacle is a factor that hinders the authorization of data backup for the device to be extracted. If the first obstacle exists, a first processing solution for the first obstacle is obtained, and the device to be extracted is processed accordingly according to the first processing solution to enable the extraction of electronic data in the target application in accordance with a first protocol. If the second obstacle exists, a second processing solution for the second obstacle is obtained, and the device to be extracted is processed accordingly according to the second processing solution to obtain data backup permission for the device to be extracted, so that the extraction of electronic data in the target application can be enabled in accordance with the first protocol.

[0083] In one embodiment, an application data acquisition device further includes a parsing module for acquiring extracted electronic data; decrypting the extracted electronic data to obtain user data of the target application; and parsing the user data to obtain deleted electronic data in the target application.

[0084] Specific limitations regarding the data acquisition device for the application can be found in the limitations on the data acquisition method for the application described above, and will not be repeated here. Each module in the aforementioned data acquisition device for the application can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0085] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a data acquisition method for an application program. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0086] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0087] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps: identifying a backup application in a device to be extracted; establishing a communication response with the backup application; obtaining a first backup protocol, wherein the first backup protocol is a backup protocol for a target application in the device to be extracted; sending the first backup protocol to the backup application based on the communication response; establishing a first protocol response with the backup application according to the first backup protocol; and extracting electronic data from the target application according to the first protocol response.

[0088] In one embodiment, when the processor executes the computer program to implement the above-described steps of establishing a communication response with the backup application, it specifically implements the following steps: obtaining a second backup protocol, wherein the second backup protocol is the backup protocol of the backup application; sending a backup request to the backup application according to the second backup protocol, wherein the backup application returns handshake protocol information upon receiving the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application according to the second backup protocol and the handshake protocol information; and establishing a communication response with the backup application according to the second protocol response.

[0089] In one embodiment, when the processor executes the computer program to implement the above-described step of sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information, it specifically implements the following steps: parsing the key and initialization vector iv in the handshake protocol information; sending a second protocol response containing the key and initialization vector iv to the backup application according to the second backup protocol; the backup application verifying the second protocol response based on the key and initialization vector iv and feeding back information indicating that the second protocol response has been verified when the verification is successful; and establishing a communication response with the backup application according to the second protocol response when the information indicating that the second protocol response has been verified is received.

[0090] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining necessary protocols from a second backup protocol according to preset filtering conditions, wherein the necessary protocols are protocols used by the electronic data of the backup target application; and generating a first backup protocol according to the necessary protocols.

[0091] In one embodiment, when the processor executes the computer program, it further performs the following steps: identifying the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; identifying the version of the backup application based on the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; and obtaining a second backup protocol based on the version of the backup application.

[0092] In one embodiment, when the processor executes the computer program, it further performs the following steps: detecting whether there is a first obstacle and a second obstacle in the device to be extracted, wherein the first obstacle is a factor that hinders the extraction of electronic data from the device to be extracted, and the second obstacle is a factor that hinders the authorization of data backup of the device to be extracted; if there is a first obstacle, obtaining a first processing solution for the first obstacle, and processing the device to be extracted according to the first processing solution so as to be able to extract electronic data in the target application according to the first protocol; if there is a second obstacle, obtaining a second processing solution for the second obstacle, and processing the device to be extracted according to the second processing solution so as to obtain data backup permission for the device to be extracted, thereby enabling the extraction of electronic data in the target application according to the first protocol.

[0093] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring extracted electronic data; decrypting the extracted electronic data to obtain user data of the target application; and parsing the user data to obtain electronic data that has been deleted in the target application.

[0094] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon. When executed by a processor, the computer program performs the following steps: identifying a backup application in a device to be extracted; establishing a communication response with the backup application; obtaining a first backup protocol, the first backup protocol being a backup protocol for a target application in the device to be extracted; sending the first backup protocol to the backup application based on the communication response; establishing a first protocol response with the backup application according to the first backup protocol; and extracting electronic data from the target application according to the first protocol response.

[0095] In one embodiment, when the computer program is executed by the processor to implement the above-described steps of establishing a communication response with the backup application, the specific steps are as follows: obtaining a second backup protocol, wherein the second backup protocol is the backup protocol of the backup application; sending a backup request to the backup application according to the second backup protocol, wherein the backup application returns handshake protocol information upon receiving the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application according to the second backup protocol and the handshake protocol information; and establishing a communication response with the backup application according to the second protocol response.

[0096] In one embodiment, when the computer program is executed by the processor to implement the above-described step of sending a second protocol response to the backup application according to the second backup protocol and handshake protocol information, the specific steps are as follows: parsing the key and initialization vector iv in the handshake protocol information; sending a second protocol response containing the key and initialization vector iv to the backup application according to the second backup protocol; the backup application verifying the second protocol response based on the key and initialization vector iv and feeding back information indicating that the second protocol response has been verified when the verification is successful; and establishing a communication response with the backup application according to the second protocol response when the information indicating that the second protocol response has been verified is received.

[0097] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: obtaining necessary protocols from a second backup protocol according to preset filtering conditions, wherein the necessary protocols are protocols used by the electronic data of the backup target application; and generating a first backup protocol according to the necessary protocols.

[0098] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: identifying the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; identifying the version of the backup application based on the brand of the device to be extracted, the operating system of the device to be extracted, and the backup application; and obtaining a second backup protocol based on the version of the backup application.

[0099] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: detecting whether there is a first obstacle and a second obstacle in the device to be extracted, wherein the first obstacle is a factor that hinders the extraction of electronic data from the device to be extracted, and the second obstacle is a factor that hinders the authorization of data backup of the device to be extracted; if the first obstacle exists, obtaining a first processing solution for the first obstacle, and processing the device to be extracted according to the first processing solution so as to be able to extract electronic data in the target application according to the first protocol; if the second obstacle exists, obtaining a second processing solution for the second obstacle, and processing the device to be extracted according to the second processing solution so as to obtain data backup permission for the device to be extracted, thereby enabling the extraction of electronic data in the target application according to the first protocol.

[0100] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: acquiring extracted electronic data; decrypting the extracted electronic data to obtain user data of the target application; and parsing the user data to obtain electronic data that has been deleted in the target application.

[0101] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0102] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0103] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data acquisition method of an application program, the method comprising: identifying a backup application program to be extracted in a device, acquiring a second backup protocol, the second backup protocol being a backup protocol of the backup application program; sending a backup request to the backup application program according to the second backup protocol, the backup application program returning handshake protocol information when receiving the backup request; receiving the handshake protocol information, and sending a second protocol response to the backup application program according to the second backup protocol and the handshake protocol information; establishing a communication response with the backup application program according to the second protocol response; acquiring a necessary protocol from the second backup protocol according to a preset screening condition, the necessary protocol being a protocol used by electronic data of a target application program, the electronic data of the target application program being a document, a picture or a text, the preset screening condition being a screening condition of the document, a screening condition of the picture or a screening condition of the text, the acquiring of the necessary protocol from the second backup protocol according to the preset screening condition comprising: acquiring one or more protocols from the second backup protocol according to the screening condition of the document, the screening condition of the picture or the screening condition of the text, the one or more protocols constituting the necessary protocol; generating a first backup protocol according to the necessary protocol; sending the first backup protocol to the backup application program based on the communication response; establishing a first protocol response with the backup application program according to the first backup protocol; extracting the electronic data in the target application program according to the first protocol response.

2. The method of claim 1, wherein, The sending of the second protocol response to the backup application program according to the second backup protocol and the handshake protocol information comprises: parsing a key and an initial vector iv in the handshake protocol information; sending a second protocol response containing the key and the initial vector iv to the backup application program according to the second backup protocol, the backup application program verifying the second protocol response based on the key and the initial vector iv and feeding back information that the second protocol response verification is passed when the verification is passed; establishing a communication response with the backup application program according to the second protocol response when receiving the information that the second protocol response verification is passed.

3. The method of claim 1, wherein, The method further comprises: identifying a brand of the device to be extracted, an operating system of the device to be extracted and the backup application program; identifying a version of the backup application program according to the brand of the device to be extracted, the operating system of the device to be extracted and the backup application program; acquiring the second backup protocol according to the version of the backup application program.

4. The method of claim 1, wherein, The method further comprises: detecting whether a first hindering factor and a second hindering factor exist in the device to be extracted, the first hindering factor being a factor hindering the extraction of electronic data of the device to be extracted, the second hindering factor being a factor hindering the backup authorization of data of the device to be extracted; If the first obstacle factor exists, a first processing scheme of the first obstacle factor is acquired, and the corresponding processing of the first processing scheme is performed on the device to be extracted, so that the electronic data in the target application program can be extracted according to the first protocol response; If the second obstacle factor exists, a second processing scheme of the second obstacle factor is acquired, and the corresponding processing of the second processing scheme is performed on the device to be extracted, so that the data backup permission of the device to be extracted is obtained, and the electronic data in the target application program can be extracted according to the first protocol response.

5. The method of claim 1, wherein, The method further comprises: acquiring the extracted electronic data; performing data decryption on the extracted electronic data to obtain user data of the target application program; performing data analysis on the user data to obtain the electronic data that has been deleted in the target application program.

6. A data acquisition apparatus of an application program, characterized by comprising: The device comprises: a first establishing module configured to identify a backup application program in a device to be extracted, acquire a second backup protocol, the second backup protocol being a backup protocol of the backup application program, send a backup request to the backup application program according to the second backup protocol, receive handshake protocol information returned by the backup application program when the backup request is received, receive the handshake protocol information, and send a second protocol response to the backup application program according to the second backup protocol and the handshake protocol information; and establish a communication response with the backup application program according to the second protocol response; an acquiring module configured to acquire necessary protocols from the second backup protocol according to preset filtering conditions, the necessary protocols being protocols used by electronic data of a target application program to be backed up; wherein the electronic data of the target application program is a document, a picture, or a text, the preset filtering conditions are a filtering condition of a document, a filtering condition of a picture, or a filtering condition of a text, and the acquiring of the necessary protocols from the second backup protocol according to the preset filtering conditions comprises: acquiring one or more protocols from the second backup protocol according to the filtering condition of the document, the filtering condition of the picture, or the filtering condition of the text, the one or more protocols constituting the necessary protocols; and generating a first backup protocol according to the necessary protocols; a sending module configured to send the first backup protocol to the backup application program based on the communication response; a second establishing module configured to establish a first protocol response with the backup application program according to the first backup protocol; an extracting module configured to extract electronic data in the target application program according to the first protocol response.

7. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images