Component configuration method and system for electronic evidence analysis

Abstract

The application discloses a component configuration method and system for electronic evidence analysis, and belongs to the technical field of computers. The component configuration method for electronic evidence analysis can obtain corresponding configuration information and configuration logic according to different requirements, debug configuration components corresponding to the configuration information according to the configuration logic, obtain corresponding configuration files, and then extract data, analyze data and obtain analysis results from the configuration files on an object to be analyzed. The functional modules are modularized to adapt to different requirements, corresponding configuration files can be configured according to different requirements, and the configuration files are applied to extract and analyze electronic evidence, so that the method is high in flexibility and reusability.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a component configuration method and system for electronic evidence analysis. Background Technology

[0002] With the development of the electronic information industry, internet technologies such as big data and cloud computing have permeated all aspects of social life, making the probative role of electronic evidence in ascertaining the facts of cases increasingly prominent. At the same time, with the increasing volume and diversification of electronic data types and structures, the requirements for electronic evidence analysis are also rising.

[0003] Traditional electronic evidence analysis systems rely on predefined evidence collection and analysis logic, making them uncustomizable to new software or different needs. The evidence collection process is relatively fixed, mainly consisting of three stages: data extraction, data parsing, and data storage. Because electronic evidence analysis systems are tightly coupled, they suffer from poor portability, low reusability, and difficulty in expansion and maintenance, making it impossible to modify and adjust them in a timely manner to meet new requirements. Traditional systems primarily focus on the collection of electronic evidence, extracting data from the evidence object through data backup, but without analyzing or processing the extracted data. For example, financial data extracted from WeChat is not analyzed, nor is extracted user GPS information. Furthermore, the proprietary formats used in traditional data extraction and storage methods prevent data exchange (data from different evidence collection software cannot be effectively supplemented, exchanged, or corroborated), resulting in low utilization of electronic data.

[0004] In summary, existing electronic evidence analysis systems suffer from problems such as lack of scalability, poor reusability, and low data utilization. Summary of the Invention

[0005] To address the issue of poor reusability in existing electronic evidence analysis systems, a component configuration method and system for electronic evidence analysis, designed with configurable components, are provided.

[0006] This invention provides a component configuration method for electronic evidence analysis, comprising:

[0007] Obtain configuration information and configuration logic, wherein the configuration information includes configuration scripts for configuration components, and the configuration logic includes the execution order of the configuration scripts;

[0008] The configuration components corresponding to the configuration information are debugged according to the configuration logic to generate a configuration file;

[0009] Data extraction and analysis are performed on the object to be analyzed according to the configuration file to obtain analysis results.

[0010] Optionally, before obtaining the configuration information and configuration logic, the following steps are also included:

[0011] Receive configuration instructions;

[0012] According to the configuration instruction, extract the component to be configured from the component library that corresponds to the configuration instruction;

[0013] Obtain the change notification of the component to be configured and the configuration script of the component after the change;

[0014] The configuration information of the component to be configured is updated according to the modified configuration script, and the corresponding configuration information is stored in the component library.

[0015] Optionally, the step of retrieving the component to be configured from the component library according to the configuration instruction further includes:

[0016] Identify whether the component library contains the component to be configured that corresponds to the configuration instruction;

[0017] If the configuration component in the component library does not match the configuration instruction, a notification that there is no corresponding configuration component will be generated.

[0018] If the configuration component in the component library matches the configuration instruction, the component to be configured corresponding to the configuration instruction is extracted from the component library according to the configuration instruction.

[0019] Optionally, the component library includes multiple different types of access interface configuration components, and / or data transformation components, and / or data parsing configuration components, and / or data analysis configuration components.

[0020] Optionally, the process of obtaining configuration information and configuration logic includes:

[0021] Collect configuration requests input by the user, the configuration requests including component logic;

[0022] Retrieve the configuration information corresponding to the configuration request from the component library;

[0023] The configuration logic is generated based on the configuration components corresponding to the configuration information and the component logic.

[0024] Optionally, the step of debugging the configuration component corresponding to the configuration information according to the configuration logic and generating a configuration file includes:

[0025] Each configuration component corresponds to a component icon;

[0026] The component icon corresponding to the configuration component is displayed in the preset configuration interface;

[0027] The execution order of the component icons displayed in the preset configuration interface is marked according to the configuration logic;

[0028] When debugging the configuration components corresponding to the configuration information according to the configuration logic, the current debugging progress is displayed on the preset configuration interface;

[0029] If debugging is successful, the corresponding configuration file will be generated.

[0030] Optionally, the configuration components adopt a preset format.

[0031] Optionally, the step of extracting and analyzing data from the object to be analyzed according to the configuration file to obtain analysis results includes:

[0032] Data is extracted from the object to be analyzed according to the configuration file to obtain the data to be analyzed.

[0033] Identify the data type of the data to be analyzed, with each data type corresponding to an analysis model;

[0034] The analysis model corresponding to the data type of the data to be analyzed is used to analyze the data and generate analysis results.

[0035] The present invention also provides a component configuration system for electronic evidence analysis, comprising:

[0036] An acquisition unit is used to acquire configuration information and configuration logic, wherein the configuration information includes configuration scripts for configuration components, and the configuration logic includes the execution order of the configuration scripts;

[0037] The debugging unit is used to debug the configuration components corresponding to the configuration information according to the configuration logic and generate a configuration file;

[0038] The processing unit is used to extract and analyze data of the object to be analyzed according to the configuration file in order to obtain analysis results.

[0039] Optional, also includes:

[0040] The receiving unit is used to receive configuration instructions;

[0041] The extraction unit is used to extract the component to be configured from the component library according to the configuration instruction;

[0042] The change unit is used to obtain the change notification of the component to be configured and the configuration script of the component to be configured after the change;

[0043] The update unit is used to update the configuration information of the component to be configured according to the modified configuration script, and store the corresponding configuration information in the component library.

[0044] The beneficial effects of the above technical solution are as follows:

[0045] In this technical solution, the component configuration method and system for electronic evidence analysis can acquire corresponding configuration information and configuration logic according to different needs. Based on the configuration logic, the configuration components corresponding to the configuration information are debugged to obtain corresponding configuration files. These configuration files are then used to extract and analyze data from the object to be analyzed, thereby obtaining analysis results. The modular design adapts to different needs, allowing for the configuration of corresponding configuration files according to different requirements. These configuration files are then used for the extraction and analysis of electronic evidence, offering high flexibility and reusability. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating an embodiment of the component configuration method for electronic evidence analysis according to the present invention.

[0047] Figure 2 This is a flowchart illustrating another embodiment of the component configuration method for electronic evidence analysis according to the present invention.

[0048] Figure 3 A flowchart illustrating one embodiment of the present invention for obtaining configuration information and configuration logic;

[0049] Figure 4 A flowchart illustrating one embodiment of generating a configuration file for this invention;

[0050] Figure 5 This is a flowchart illustrating an embodiment of the present invention that extracts and analyzes data from the object to be analyzed to obtain analysis results.

[0051] Figure 6 This is a block diagram of one embodiment of the component configuration system for electronic evidence analysis described in this invention. Detailed Implementation

[0052] The advantages of the present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments.

[0053] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0054] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0055] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0056] In the description of this invention, it should be understood that the numerical labels before the steps do not indicate the order in which the steps are performed, but are only used to facilitate the description of this invention and to distinguish each step, and therefore should not be construed as a limitation of this invention.

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0059] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0060] Example 1

[0061] See Figure 1 As shown, this embodiment provides a component configuration method for electronic evidence analysis, including the following steps:

[0062] S1. Obtain configuration information and configuration logic.

[0063] The configuration information includes configuration scripts for configuration components, and the configuration logic includes the execution order of the configuration scripts. The configuration logic may also include combination logic for configuration components and execution timing logic.

[0064] It should be noted that the configuration components use a preset format. The preset format can be a compressed file format, such as .rar, .zip, etc., which has a small file size and is a commonly used format, facilitating the import, export, and sharing of configuration components.

[0065] In a preferred embodiment, see Figure 2 As shown, the following steps may be included before performing step S1:

[0066] A1. Receive configuration instructions;

[0067] The configuration instruction includes a component identifier corresponding to the configuration component.

[0068] A2. Extract the component to be configured from the component library according to the configuration instruction.

[0069] It should be noted that the component library includes multiple different types of access interface configuration components, and / or data conversion components, and / or data parsing configuration components, and / or data analysis configuration components. The component library stores basic core function configuration components capable of extracting and analyzing electronic evidence. The configuration scripts for these components can be in binary encoding, which supports flexible programming, facilitates adjustment and modification, and allows users to modify and share them across different clients.

[0070] In this embodiment, the component library is traversed according to the component identifier in the configuration instruction, and then the matching configuration component is extracted.

[0071] In practical applications, based on the access interface type of the object to be analyzed, the corresponding access interface component can be selected from the component library to achieve the goal of accessing different objects to be analyzed. Different data conversion components can be selected based on the different types of data extracted to convert the data to be analyzed into data of a uniform format, facilitating data exchange of the extracted electronic data and improving data utilization.

[0072] In this embodiment, the BCP standard data format can be used. The imported data is converted to the BCP standard data format to facilitate unified management and analysis of the extracted data. Standardizing the data to be processed using the BCP standard data format is beneficial for effective analysis of the extracted data.

[0073] In one embodiment, before performing step A2, the following may be included:

[0074] B1. Identify whether the component library contains the component to be configured corresponding to the configuration instruction.

[0075] If yes, proceed to step A2; if no, proceed to step B2.

[0076] B2. Generate a notification that no corresponding configuration component is available.

[0077] In this embodiment, if there is no component to be configured that matches the configuration instruction in the configuration components, the user can write a configuration script and add it to the component library.

[0078] A3. Obtain the change notification of the component to be configured and the configuration script of the component after the change.

[0079] A4. Update the configuration information of the component to be configured according to the modified configuration script, and store the corresponding configuration information in the component library.

[0080] As an example, and not a limitation, data processing logic can be implemented using components, giving these components the data processing capabilities of traditional forensic software. For instance, a Python script could be developed to process QQ data, generating a QQ data parsing and processing component. This component could be provided to any user who needs it for parsing QQ data, and its functionality could be expanded to include new features.

[0081] Further, see Figure 3 As shown, step S1 may include the following steps:

[0082] S11. Collect configuration requests input by the user, wherein the configuration requests include component logic.

[0083] The configuration request includes the component identifier corresponding to the configuration component. The component logic is the logic of the pre-configured execution component.

[0084] S12. Obtain the configuration information corresponding to the configuration request from the component library.

[0085] Based on the component identifier contained in the configuration request, query the component library for the configuration information of the matching configuration component.

[0086] S13. Generate the configuration logic based on the configuration components corresponding to the configuration information and the component logic.

[0087] S2. Debug the configuration components corresponding to the configuration information according to the configuration logic and generate a configuration file.

[0088] In this embodiment, each configuration component corresponds to a component icon.

[0089] Further, see Figure 4 As shown, step S2 may include the following steps:

[0090] S21. Display the component icon corresponding to the configuration component in the preset configuration interface;

[0091] S22. Mark the execution order of the component icons displayed in the preset configuration interface according to the configuration logic;

[0092] S23. When debugging the configuration component corresponding to the configuration information according to the configuration logic, the current debugging progress is displayed on the preset configuration interface;

[0093] S24. If debugging is successful, the corresponding configuration file will be generated.

[0094] In this embodiment, if debugging fails, a debugging failure notification is generated.

[0095] S3. Extract and analyze data from the object to be analyzed according to the configuration file to obtain the analysis results.

[0096] Further, see Figure 5 As shown, step S3 may include the following steps:

[0097] S31. Extract data from the object to be analyzed according to the configuration file to obtain the data to be analyzed;

[0098] S32. Identify the data type of the data to be analyzed, with each data type corresponding to an analysis model;

[0099] S33. Using the analysis model corresponding to the data type of the data to be analyzed, the data to be analyzed is analyzed to generate analysis results.

[0100] As examples, not limitations, when the data to be analyzed is system information, a log analysis model can be used to analyze the system information; when the data to be analyzed is financial data, a financial analysis model can be used to analyze the financial data; and when the data to be analyzed is location data, a path analysis model can be used to analyze the location data.

[0101] In this embodiment, different analysis methods can be selected according to the different types of data to be analyzed, which improves the diversity of analysis modes to meet the analysis needs of different types of electronic evidence.

[0102] The component configuration method in this embodiment allows users to open existing components and view their implementation code and processing logic. Users can modify the component's processing logic, add or supplement new functions; they can also generate new components that borrow functions from the original components to improve and expand their functionality. The components primarily support Python language development and are essentially collections of Python scripts. The integrated development environment (IDE) integrates Python language editing, running, and debugging functions, enabling component functionality debugging through Python code debugging capabilities.

[0103] In this embodiment, the component configuration method for electronic evidence analysis can obtain corresponding configuration information and configuration logic according to different needs. Based on the configuration logic, the configuration components corresponding to the configuration information are debugged to obtain the corresponding configuration file. Then, the configuration file is used to extract and analyze data from the object to be analyzed, thereby obtaining the analysis results. By modularizing the functions to adapt to different needs, corresponding configuration files can be configured according to different requirements, and then the configuration files can be used for the extraction and analysis of electronic evidence, resulting in high flexibility and reusability.

[0104] This embodiment provides an integrated development environment for configuration components, which supports editing and secondary development of configuration components in the component library. It can generate corresponding configuration files according to configuration requirements, thereby running and debugging configuration components, extracting and analyzing data from the object to be analyzed, and obtaining analysis results.

[0105] Example 2

[0106] See Figure 6 As shown, this embodiment provides a component configuration system 1 for electronic evidence analysis, which may include: an acquisition unit 11, a debugging unit 12, and a processing unit 13.

[0107] The acquisition unit 11 is used to acquire configuration information and configuration logic. The configuration information includes the configuration script of the configuration component, and the configuration logic includes the execution order of the configuration script.

[0108] The configuration information includes configuration scripts for configuration components, and the configuration logic includes the execution order of the configuration scripts. The configuration logic may also include combination logic for configuration components and execution timing logic.

[0109] It should be noted that the configuration components use a preset format. The preset format can be a compressed file format, such as .rar, .zip, etc., which has a small file size and is a commonly used format, facilitating the import, export, and sharing of configuration components.

[0110] In a preferred embodiment, the component configuration system 1 for electronic evidence analysis may further include:

[0111] The receiving unit is used to receive configuration instructions;

[0112] The configuration instruction includes a component identifier corresponding to the configuration component.

[0113] The extraction unit is used to extract the component to be configured from the component library according to the configuration instruction.

[0114] It should be noted that the component library includes multiple different types of access interface configuration components, and / or data conversion components, and / or data parsing configuration components, and / or data analysis configuration components. The component library stores basic core function configuration components capable of extracting and analyzing electronic evidence. The configuration scripts for these components can be in binary encoding, which supports flexible programming, facilitates adjustment and modification, and allows users to modify and share them across different clients.

[0115] In this embodiment, the component library is traversed according to the component identifier in the configuration instruction, and then the matching configuration component is extracted.

[0116] In practical applications, based on the access interface type of the object to be analyzed, the corresponding access interface component can be selected from the component library to achieve the goal of accessing different objects to be analyzed. Different data conversion components can be selected based on the different types of data extracted to convert the data to be analyzed into data of a uniform format, facilitating data exchange of the extracted electronic data and improving data utilization.

[0117] In this embodiment, the BCP standard data format can be used. The imported data is converted to the BCP standard data format to facilitate unified management and analysis of the extracted data. Standardizing the data to be processed using the BCP standard data format is beneficial for effective analysis of the extracted data.

[0118] In one embodiment, the extraction unit is further configured to identify whether there is a component to be configured in the component library corresponding to the configuration instruction; if so, extract the component to be configured corresponding to the configuration instruction from the component library according to the configuration instruction; if not, generate a notification that there is no corresponding configuration component.

[0119] In this embodiment, if there is no component to be configured that matches the configuration instruction in the configuration components, the user can write a configuration script and add it to the component library.

[0120] The change unit is used to obtain the change notification of the component to be configured and the configuration script of the component to be configured after the change.

[0121] The update unit is used to update the configuration information of the component to be configured according to the modified configuration script, and store the corresponding configuration information in the component library.

[0122] As an example, and not a limitation, data processing logic can be implemented using components, giving these components the data processing capabilities of traditional forensic software. For instance, a Python script could be developed to process QQ data, generating a QQ data parsing and processing component. This component could be provided to any user who needs it for parsing QQ data, and its functionality could be expanded to include new features.

[0123] Furthermore, the acquisition unit 11 may include:

[0124] The data acquisition module is used to collect configuration requests input by the user, and the configuration requests include component logic.

[0125] The configuration request includes the component identifier corresponding to the configuration component. The component logic is the logic of the pre-configured execution component.

[0126] The acquisition module is used to acquire configuration information corresponding to the configuration request from the component library.

[0127] Based on the component identifier contained in the configuration request, query the component library for the configuration information of the matching configuration component.

[0128] The generation module is used to generate the configuration logic based on the configuration components corresponding to the configuration information and the component logic.

[0129] The debugging unit 12 is used to debug the configuration components corresponding to the configuration information according to the configuration logic and generate a configuration file.

[0130] In this embodiment, each configuration component corresponds to a component icon.

[0131] Furthermore, the debugging unit 12 is used to display component icons corresponding to the configuration components in a preset configuration interface; mark the execution order of the component icons displayed in the preset configuration interface according to the configuration logic; when debugging the configuration components corresponding to the configuration information according to the configuration logic, display the current debugging progress in the preset configuration interface; if the debugging is successful, generate the corresponding configuration file; if the debugging fails, generate a debugging failure notification.

[0132] The processing unit 13 is used to extract and analyze data of the object to be analyzed according to the configuration file in order to obtain analysis results.

[0133] Furthermore, the processing unit 13 is used to extract data from the object to be analyzed according to the configuration file to obtain the data to be analyzed; identify the data type of the data to be analyzed, with each data type corresponding to an analysis model; and use the analysis model corresponding to the data type of the data to be analyzed to analyze the data to be analyzed and generate analysis results.

[0134] As examples, not limitations, when the data to be analyzed is system information, a log analysis model can be used to analyze the system information; when the data to be analyzed is financial data, a financial analysis model can be used to analyze the financial data; and when the data to be analyzed is location data, a path analysis model can be used to analyze the location data.

[0135] In this embodiment, different analysis methods can be selected according to the different types of data to be analyzed, which improves the diversity of analysis modes to meet the analysis needs of different types of electronic evidence.

[0136] The component configuration system 1 for electronic evidence analysis in this embodiment can open existing components and view their implementation code and processing logic. Users can modify the component's processing logic, add or supplement new functions; they can also generate new components and improve and expand upon the functions of the original components. The components primarily support Python language development and are essentially collections of Python scripts. The integrated development environment integrates Python language editing, running, and debugging functions, enabling component functionality debugging through Python code debugging capabilities.

[0137] In this embodiment, the component configuration system 1 for electronic evidence analysis can obtain corresponding configuration information and configuration logic according to different needs. Based on the configuration logic, it debugs the configuration components corresponding to the configuration information to obtain corresponding configuration files. These configuration files are then used to extract and analyze data from the object to be analyzed, thereby obtaining analysis results. By modularizing functions to adapt to different needs, it can configure corresponding configuration files according to different requirements, and then apply these configuration files to extract and analyze electronic evidence, demonstrating high flexibility and reusability.

[0138] This embodiment provides an integrated development environment for configuration components, which supports editing and secondary development of configuration components in the component library. It can generate corresponding configuration files according to configuration requirements, thereby running and debugging configuration components, extracting and analyzing data from the object to be analyzed, and obtaining analysis results.

[0139] In this embodiment, the component configuration system 1 for electronic evidence analysis includes data extraction, data parsing, and data analysis functions for electronic evidence that users need. It also provides a complete component development environment, which can edit and generate configuration files according to evidence collection and analysis needs, realize the reuse and decoupling of configuration components, and can flexibly adjust configuration components to adapt to special needs, or use existing components to efficiently handle general needs.

[0140] The component configuration system 1 for electronic evidence analysis has a runtime environment consisting of a script execution environment. It uses a Python scripting language interpreter as the runtime environment for Python scripts. All configuration components are written in Python and then run using this runtime environment. The system's component library provides the main functions required for writing analysis components, including data visualization, data forensics, data parsing, and the BCP standard format. It allows users to perform various actions on the configuration components, including component execution, debugging, editing, and creation. Based on common forensic logic, the system categorizes component behaviors into data import, data parsing, data analysis, data visualization, and data export, and provides specific templates for each behavior to facilitate user operation.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A component configuration method for electronic evidence analysis, characterized by, The application comprises: acquiring configuration information and configuration logic, wherein the configuration information comprises configuration scripts of configuration components, and the configuration logic comprises execution sequences of the configuration scripts; the configuration logic further comprises combination logic of the configuration components and timing logic of execution; debugging the configuration components corresponding to the configuration information according to the configuration logic to generate configuration files; performing data extraction and data analysis on an object to be analyzed according to the configuration files to obtain analysis results; before the step of acquiring the configuration information and the configuration logic, the method further comprises: receiving a configuration instruction; extracting a configuration component to be configured corresponding to the configuration instruction from a component library according to the configuration instruction; acquiring a change notification of the configuration component to be configured and a configuration script of the configuration component to be configured after the change; updating configuration information of the current configuration component to be configured according to the configuration script after the change, and storing the corresponding configuration information in the component library; the step of acquiring the configuration information and the configuration logic comprises: collecting a configuration request input by a user, wherein the configuration request comprises component logic and a component identifier corresponding to the configuration component, and the component logic is logic of an execution component configured in advance; querying and acquiring configuration information matched with the component identifier in the component library according to the component identifier contained in the configuration request; generating the configuration logic according to the configuration component corresponding to the configuration information and the component logic.

2. The component configuration method for electronic evidence analysis according to claim 1, wherein, before the step of extracting the configuration component to be configured corresponding to the configuration instruction from the component library according to the configuration instruction, the method further comprises: identifying whether the component library contains the configuration component to be configured corresponding to the configuration instruction; if the configuration component in the component library does not match the configuration instruction, generating a notification that there is no corresponding configuration component; if the configuration component in the component library matches the configuration instruction, extracting the configuration component to be configured corresponding to the configuration instruction from the component library according to the configuration instruction.

3. The component configuration method for electronic evidence analysis according to claim 1, wherein, The component library comprises multiple different types of access interface configuration components, and / or data conversion components, and / or data analysis type configuration components.

4. The component configuration method for electronic evidence analysis according to claim 1, wherein, The step of debugging the configuration components corresponding to the configuration information according to the configuration logic to generate configuration files comprises: each configuration component corresponds to a component icon; displaying the component icon corresponding to the configuration component in a preset configuration interface; marking the execution sequence of the component icon displayed in the preset configuration interface according to the configuration logic; displaying the current debugging progress in the preset configuration interface according to the configuration logic for debugging the configuration components corresponding to the configuration information; if the debugging is successful, generating the corresponding configuration file.

5. The component configuration method for electronic evidence analysis according to claim 1, wherein, The configuration component adopts a preset format.

6. The component configuration method for electronic evidence analysis according to claim 1, wherein, The step of performing data extraction and data analysis on an object to be analyzed according to the configuration files to obtain analysis results comprises: performing data extraction on the object to be analyzed according to the configuration files to obtain data to be analyzed; identifying data types of the data to be analyzed, wherein each data type corresponds to an analysis model; performing analysis on the data to be analyzed by using the analysis model corresponding to the data type of the data to be analyzed to generate analysis results.

7. An assembly configuration system for electronic evidence analysis, characterized by The application discloses a component configuration method for electronic evidence analysis. An acquisition unit is configured to acquire configuration information and configuration logic, wherein the configuration information comprises a configuration script of a configuration component, and the configuration logic comprises an execution sequence of the configuration script. The configuration logic further comprises combination logic and timing logic of the configuration component. A debugging unit is configured to debug the configuration component corresponding to the configuration information according to the configuration logic, and generate a configuration file. A processing unit is configured to perform data extraction and data analysis on an object to be analyzed according to the configuration file, and obtain an analysis result.

8. The component configuration system for electronic evidence analysis of claim 7, wherein, The application further discloses a configuration method for electronic evidence analysis. A receiving unit is configured to receive a configuration instruction. An extraction unit is configured to extract a configuration component to be configured corresponding to the configuration instruction from a component library. A change unit is configured to acquire a change notification of the configuration component to be configured and a configuration script of the configuration component to be configured after the change. An update unit is configured to update configuration information of the current configuration component to be configured according to the configuration script after the change, and store the corresponding configuration information in the component library.

Images