WiFi evidence obtaining method and system, storage medium and electronic equipment

Abstract

The invention provides a WiFi evidence obtaining method and system, a storage medium and electronic equipment. The WiFi evidence obtaining method comprises the following steps: a router swipes into an OpenWrt system according to a received first instruction; the router performs function setting according to the received second instruction; the evidence obtaining device generates a WiFi hotspot based on the router, and the evidence obtaining device is in communication connection with the router in a wired mode; a device to be subjected to evidence collection is connected with the WiFi hotspot; and the evidence obtaining device carries out WiFi evidence obtaining through the WiFi hotspot. The WiFi evidence obtaining method has relatively high evidence obtaining accuracy and evidence obtaining efficiency.

Description

Technical Field

[0001] The present application belongs to the technical field of data forensics, and relates to a WiFi forensics method, and in particular to a WiFi forensics method, system, storage medium and electronic device. Background Art

[0002] With the popularity of wireless networks and the widespread use of mobile devices, more and more evidence exists in digital form in various devices. WiFi forensics provides a way to obtain this evidence without physical contact. WiFi forensics refers to the process of collecting, analyzing and preserving evidence by connecting the device to be collected through WiFi using wireless network technology. This method of evidence collection has become increasingly important in the modern information society, especially in the fields of legal investigation and network security inspection. For example, in legal investigations, WiFi forensics can be used to extract key information such as chat records, emails, browsing history, files and pictures from suspects' mobile phones, tablets or computers. These data can become important evidence in the case and help law enforcement agencies restore the truth faster and more accurately. However, existing WiFi forensics methods have problems such as inaccurate evidence collection and low evidence collection efficiency. Summary of the invention

[0003] The embodiments of the present application provide a WiFi evidence collection method, system, storage medium and electronic device for improving the accuracy and efficiency of WiFi evidence collection.

[0004] In a first aspect, an embodiment of the present application provides a WiFi forensics method, which includes: a router is flashed with an OpenWrt system according to a first instruction received; the router performs function settings according to a second instruction received; a forensics device generates a WiFi hotspot based on the router, and the forensics device is connected to the router in a wired communication manner; a device to be forensically collected connects to the WiFi hotspot; and the forensics device performs WiFi forensics through the WiFi hotspot.

[0005] In an implementation of the first aspect, flashing the OpenWrt system into the router according to the received first instruction includes: the router performing the following steps according to the received first instruction: entering recovery mode and opening an SSH connection port; flashing the native OpenWrt system and importing the OpenWrt backup package.

[0006] In an implementation manner of the first aspect, the second instruction is a uci instruction.

[0007] In an implementation of the first aspect, the uci instruction includes a virtual network port creation instruction, a default gateway configuration instruction, a WiFi signal creation instruction, a firewall rule creation instruction and / or a port forwarding setting instruction.

[0008] In an implementation of the first aspect, the WiFi evidence collection method further includes: selecting a router mode to perform WiFi evidence collection through a forensic software interface of the forensic device.

[0009] In an implementation of the first aspect, the WiFi forensics method further includes: the forensics device obtains a hotspot name and password that meets the current WiFi forensics task and generates a QR code, and the device to be forensics connects to the WiFi hotspot by scanning the QR code.

[0010] In an implementation manner of the first aspect, there are multiple WiFi hotspots, and the WiFi hotspots have at least two frequency bands.

[0011] In a second aspect, an embodiment of the present application provides a WiFi forensics system, which includes a router, a forensics device connected to the router in a wired communication manner, and a device to be forensics, and is used to implement the WiFi forensics method described in any one of the first aspects of the embodiments of the present application.

[0012] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the WiFi forensics method described in any one of the first aspects of the embodiments of the present application is implemented.

[0013] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a memory storing a computer program; and a processor communicatively connected to the memory, for executing the WiFi forensics method described in any one of the first aspects of the embodiments of the present application when the computer program is called.

[0014] As described above, the WiFi evidence collection method, system, storage medium and electronic device provided in the embodiments of the present application have the following features:

[0015] Beneficial effects:

[0016] The WiFi evidence collection method releases WiFi signals by using a special router that is not connected to the external network, thereby ensuring that the device to be collected cannot automatically connect to other networks, which is conducive to improving the accuracy of evidence collection.

[0017] Compared with the technical solution of using the local network card of a computer or other evidence collection device for evidence collection, a router can provide a faster and more stable network service, which is conducive to improving the speed and stability of evidence collection. In addition, a router can also release multiple WiFi hotspots at the same time, realizing parallel evidence collection of multiple WiFi tasks, thereby greatly improving the efficiency of evidence collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Shown is a schematic diagram of an application scenario of an embodiment of the present application.

[0019] Figure 2 Shown is a flowchart of the WiFi forensics method provided in an embodiment of the present application.

[0020] Figure 3 It shows a flow chart of flashing the OpenWrt system into a router in an embodiment of the present application.

[0021] Figure 4 Shown is a flowchart of the WiFi forensics method provided in an embodiment of the present application.

[0022] Figure 5 Shown is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0023] Component number description

[0024] 1 WiFi Forensic System

[0025] 11 Router

[0026] 12 Evidence Collection Equipment

[0027] 13 Equipment to be collected

[0028] 500 Electronic equipment

[0029] 510 Memory

[0030] 520 processor

[0031] 530 Display

[0032] Steps S21 to S25

[0033] Steps S31 to S32

[0034] Steps S401 to S410 DETAILED DESCRIPTION

[0035] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0036] It should be noted that the illustrations provided in the following embodiments are only used to illustrate the basic concept of the present application in a schematic manner, and therefore the illustrations only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0037] With the popularization of wireless networks and the widespread use of mobile devices, more and more evidence exists in digital form in various devices. WiFi forensics provides a method to obtain these evidences without physical contact. WiFi forensics refers to the process of collecting, analyzing and preserving evidence by connecting the device to be collected through WiFi using wireless network technology. In some technical solutions, WiFi forensics is performed using the local network card of the evidence collection device, such as a computer. However, since the evidence collection device will be connected to other networks when performing WiFi forensics, the device to be collected, such as a mobile phone, is easily automatically connected to other networks during the evidence collection process, resulting in inaccurate evidence. In addition, the transmission speed of the local network card of the evidence collection device is often slow and the signal is unstable. Using the local network card for WiFi forensics will reduce the efficiency of evidence collection. Furthermore, the above solution cannot release multiple WiFi hotspots at the same time, resulting in the inability to perform multiple evidence collection tasks in parallel during the evidence collection process, which will further reduce the efficiency of evidence collection.

[0038] At least to address the above problems, the present application embodiment provides a WiFi evidence collection method. The technical solution in the present application embodiment will be described in detail below in conjunction with the accompanying drawings in the present application embodiment.

[0039] Figure 1 The following is a schematic diagram of an application scenario of an embodiment of the present application. Figure 1 As shown, the WiFi evidence collection system 1 includes a router 11, an evidence collection device 12 and a device to be collected 13. The router 11 is a dedicated router for WiFi evidence collection, which serves as a wireless access point in the WiFi evidence collection system 1 to create a local area network environment for the evidence collection device 12 and the device to be collected 13. The router 11 is not connected to an external network (such as the Internet), so it can ensure that the device to be collected 13 cannot automatically connect to the external network during the evidence collection process, which is conducive to improving the accuracy of evidence collection. The evidence collection device 12 is a device for data collection, analysis and storage, and is connected to the router 11 by wired communication. For example, the evidence collection device 12 can be connected to the LAN port of the router 11 using a network cable, but the present application is not limited to this. The evidence collection device 12 is, for example, a personal computer, a tablet computer, etc. The device to be collected 13 is connected to the evidence collection device 12 via a WiFi network, so that the evidence collection device 12 can perform data evidence collection. The device to be collected 13 is, for example, an Android mobile phone, but the present application is not limited to this.

[0040] Figure 2 The flowchart of the WiFi evidence acquisition method provided by the embodiment of the present application is shown. The WiFi evidence acquisition method can be applied to Figure 1 The WiFi forensics system 1 shown. Figure 2 As shown, the WiFi evidence collection method provided in the embodiment of the present application includes the following steps S21 to S25.

[0041] S21, the router is flashed with the OpenWrt system according to the received first instruction. Specifically, the user can download the OpenWrt firmware file suitable for the router model, and enter the first instruction through the management interface of the router to upload and flash the firmware. The OpenWrt system provides rich functions, such as advanced firewall settings, VLAN support, traffic control and monitoring, etc., so that the router can better meet complex network requirements and customized requirements of advanced users. By flashing the OpenWrt system, users can make full use of the hardware performance of the router and achieve more flexible and powerful network management.

[0042] S22, the router performs function settings related to WiFi forensics according to the received second instruction. Specifically, the user can input the second instruction through the management interface of the router to implement the settings of the related functions.

[0043] S23, the evidence collection device generates a WiFi hotspot based on the network service provided by the router.

[0044] S24, the device to be collected is connected to the WiFi hotspot.

[0045] S25, the evidence collection device performs WiFi evidence collection via the WiFi hotspot.

[0046] As described above, the WiFi evidence collection method provided in the embodiment of the present application uses a special router and evidence collection equipment to release WiFi signals. The router is not connected to the external network, so it can ensure that the device to be collected cannot automatically connect to other networks, which is conducive to improving the accuracy of evidence collection. In addition, compared with the solution of using the local network card of a computer or other evidence collection equipment for WiFi evidence collection, the router can provide a faster and more stable network service, which is conducive to improving the speed and stability of evidence collection. In addition, the router can release multiple WiFi hotspots at the same time in conjunction with the evidence collection equipment, realizing parallel evidence collection of multiple WiFi tasks, thereby greatly improving the efficiency of evidence collection.

[0047] See also Figure 3 In some implementations, the router flashes the OpenWrt system according to the received first instruction, including: the router receives the first instruction input by the user, and executes the following steps S31 and S32 in response to the first instruction.

[0048] S31, the router enters recovery mode and opens the SSH connection port. In recovery mode, the router will start a minimized system environment to ensure stability and operability. Opening the SSH connection port can provide an encrypted communication channel to ensure the security and integrity of data transmission and prevent unauthorized access.

[0049] S32, the router is flashed with the native OpenWrt system and the OpenWrt backup package is imported.

[0050] In some implementations, the second instruction is a uci (Unified Configuration Interface) instruction. The uci instruction is a command line tool for configuring and managing the OpenWrt system. The uci instruction provides a simplified way to read and modify the configuration file of the device, allowing the user to manage system configurations such as network settings, wireless configurations, and firewall rules through a unified interface.

[0051] In some implementations, the function settings of the router according to the uci instructions include: creating a virtual network interface, configuring a default gateway, creating a WiFi signal, creating firewall rules, and / or setting port forwarding. The uci instructions include virtual network port creation instructions, default gateway configuration instructions, WiFi signal creation instructions, firewall rule creation instructions, and / or port forwarding setting instructions. Specifically, a virtual network port refers to a logical network interface created in an operating system, which does not directly correspond to physical network hardware. Virtual network ports can be used for various network configuration and management tasks, such as implementing network isolation, virtual private networks (VPNs), bridges, etc. By creating a virtual network port, users can create multiple logical interfaces on a physical network interface, thereby improving the flexibility and management capabilities of network configuration. Firewall rules are used to control and manage policies for inbound and outbound network traffic. By creating firewall rules, it is possible to specify the types of traffic allowed or denied, source and destination addresses, port numbers, etc., to enhance network security and protect the network from unauthorized access and attacks. Port forwarding is used to direct network traffic to a specific port of a device. By setting up port forwarding, traffic from a specified port can be forwarded to the corresponding port of the corresponding device in the network.

[0052] Exemplarily, the uci instruction is, for example:

[0053] "uci set network."+wInfo.InterfaceName+"=interface". This command is used to add a new network interface in the OpenWrt network configuration. <interfacename>is the name of the interface, such as lan or wan.

[0054] "uci set network."+wInfo.InterfaceName+".ifname=lan2". This command is used to set the physical interface name of the network interface to lan2. The physical interface name (ifname) refers to the actual network interface device, such as Ethernet port, wireless interface, etc.

[0055] "uci set network."+wInfo.InterfaceName+".gateway="+global.RouterBasicIp. This command is used to set the gateway address of the network interface. <routerbasicip>, which is the basic IP address of the router.

[0056] "uci set network."+wInfo.InterfaceName+".ipaddr="+wInfo.InterfaceIp. This command is used to set the IP address of the network interface. <interfaceip>, which is the IP address of the interface in the local network.

[0057] "uci set network."+wInfo.InterfaceName+".netmask=255.255.255.0". This command is used to set the subnet mask of the network interface to 255.255.255.0. The subnet mask is used to determine the network part and the host part of the IP address.

[0058] "uci set network."+wInfo.InterfaceName+".proto=static". This command is used to set the protocol type of the network interface to static, that is, static IP address configuration.

[0059] "uci set network."+wInfo.InterfaceName+".type=bridge". This command is used to set the network interface to the bridge type, i.e., a network bridge.

[0060] It should be noted that the above only exemplarily lists several uci commands, but the present application is not limited thereto. In specific applications, users can configure uci commands according to actual needs.

[0061] In some implementations, the evidence collection device is installed with evidence collection software. The WiFi evidence collection method provided in the embodiment of the present application may also include: selecting a router mode to perform WiFi evidence collection through the evidence collection software interface of the evidence collection device.

[0062] For example, after selecting the router method for WiFi forensics, the forensics software automatically executes the router forensics process, obtains the hotspot name and password that meets the current WiFi forensics task and generates a QR code. The device to be forensic connects to the WiFi hotspot by scanning the QR code.

[0063] In some implementations, the process of generating a QR code may include the following steps.

[0064] Format the WiFi hotspot information (such as SSID, password, and encryption type) into a specific string format. The format needs to follow the WiFi Alliance's specifications to ensure compatibility and correct parsing. For example, the formatted WiFi information string structure can be: "WIFI:T: <encryption> ；S： <ssid> ；P： <password>;;", where T represents the encryption type, such as WPA, WEP, or nopass (no password). S represents SSID, that is, the name of the wireless network. P represents the password. For example, assuming that the SSID of the WiFi network is "ExampleSSID", the password is "password123", and WPA encryption is used, the formatted string is: "WIFI:T:WPA;S:ExampleSSID;P:password123;;".

[0065] Generate a QR code. Exemplarily, the process of generating a QR code may include steps such as data encoding, error correction, matrix generation, and image rendering. Data encoding is used to encode the formatted WiFi information string into QR code data. Error correction is used to add redundant data to support error correction to improve the readability and damage resistance of the QR code. Matrix generation is used to generate a QR code matrix based on the encoded data, and the matrix is ​​a square grid containing black and white modules. Image rendering is used to render the QR code matrix into an image format, such as PNG, JPEG, etc., for printing or display.

[0066] In some implementations, the forensic device performs WiFi forensics via a WiFi hotspot including the following steps.

[0067] After the device to be collected establishes a connection with the collecting device through a WiFi hotspot, the collecting device establishes an encrypted communication channel with the device to be collected through a security protocol (such as TLS / SSL) to ensure that the transmitted data will not be intercepted or tampered with in the network, thereby maintaining the confidentiality and integrity of data transmission.

[0068] The forensic device uses the forensic software to scan the data of the forensic device, and the scan objects may include the file system, application data, log files, memory data, etc. The forensic software transmits the scan results in real time through the WiFi network and marks and extracts key information, such as emails, text messages, call records, browser history, documents and pictures.

[0069] The forensic software will classify and organize the acquired data and store the data in different categories on the forensic device according to the predetermined forensic scheme. In addition, this step can further include hash verification of the acquired data to ensure the integrity and authenticity of each file or data block and prevent data from being tampered with during transmission.

[0070] For example, during the data collection process, the forensic device can also perform real-time analysis on the transmitted data, using techniques such as data mining and pattern recognition to detect abnormal activities or suspicious content.

[0071] For example, after data collection and analysis are completed, the forensic software can also automatically generate a detailed forensic report, which includes information such as data source, collection time, data type, content summary, etc.

[0072] For example, during the entire evidence collection process, the evidence collection software can record detailed operation logs, for example, including information such as the operation time, operation content, and operator of each step.

[0073] In some implementations, there may be multiple WiFi hotspots, and each WiFi hotspot may be set with an independent WiFi SSID and password. WiFi hotspots have at least two frequency bands, for example, some WiFi hotspots are 2.4GHz and some WiFi hotspots are 5GHz, to meet the needs of different WiFi tasks. The port forwarding function can ensure that the forensic device and the device to be forensic are transmitting data normally.

[0074] Next, the WiFi evidence collection method provided by the embodiment of the present application will be described in detail through a specific example. It should be noted that the content in this example is only used to explain and illustrate the WiFi evidence collection method provided by the embodiment of the present application, and is not used to limit the scope of protection of this application. In specific applications, corresponding steps can be added or deleted based on this example according to actual needs. Figure 4 The following is a flowchart of the WiFi forensics method used in this example. Figure 4 As shown, the WiFi forensics method in this example includes the following steps.

[0075] S401, flash the OpenWrt system into the router.

[0076] S402, using uci instructions to set up multiple WiFi hotspots.

[0077] S403, using uci instructions to set firewall rules.

[0078] S404, performing a WiFi task.

[0079] S405, selecting router evidence collection on the evidence collection software interface of the evidence collection device.

[0080] S406, check whether the router configuration environment is normal. If so, execute step S407, otherwise execute step S401.

[0081] S407, set up port forwarding in the router.

[0082] S408, obtaining the account and password of the released WiFi hotspot.

[0083] S409, generate a QR code.

[0084] S410, use the device to be collected evidence to scan the QR code and perform WiFi collection.

[0085] It should be noted that the above reference numerals S401 to S410 are only used to mark different steps, but not to limit the execution order of these steps.

[0086] The protection scope of the WiFi forensics method provided in the embodiment of the present application is not limited to the execution order of the steps listed above. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of the present application are included in the protection scope of the present application.

[0087] The embodiment of the present application also provides a WiFi forensics system, which can implement the WiFi forensics method described in the present application, but the implementation device of the WiFi forensics method described in the present application includes but is not limited to the structure of the WiFi forensics system listed in the present embodiment, and all structural deformations and replacements of the prior art made according to the principles of the present application are included in the protection scope of the present application.

[0088] The WiFi evidence collection system provided in the embodiment of the present application includes a router, an evidence collection device connected to the router by wired communication, and a device to be collected. The WiFi evidence collection system is configured to perform the following steps: the router flashes the OpenWrt system according to the received first instruction; the router performs function settings according to the received second instruction; the evidence collection device generates a WiFi hotspot based on the router, and the evidence collection device is connected to the router by wired communication; the device to be collected connects to the WiFi hotspot; the evidence collection device collects WiFi evidence through the WiFi hotspot.

[0089] In the several embodiments provided in the present application, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules / units is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules or units, which can be electrical, mechanical or other forms.

[0090] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present application. For example, the functional modules / units in the various embodiments of the present application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0091] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0092] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by the processor, the WiFi forensics method provided by the present application is implemented. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by instructing the processor through a program, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state hard disk (SSD)), etc.

[0093] The embodiment of the present application may also provide an electronic device. Figure 5 The structure diagram of the electronic device 500 in the embodiment of the present application is shown. Figure 5 As shown, in this embodiment, the electronic device 500 includes a memory 510 and a processor 520 .

[0094] The memory 510 in the embodiment of the present application is used to store various categories of data to support the operation of the electronic device 500. Examples of these data include: any executable program for operating on the electronic device 500, such as an operating system and an application; the operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application program may include various applications, such as a media player (MediaPlayer), a browser (Browser), etc., for implementing various application services. The WiFi forensics method provided in the embodiment of the present application can be included in the application.

[0095] Exemplarily, the memory 510 may include a computer system readable medium in the form of a volatile memory, such as a RAM and / or a cache memory. The electronic device 500 may further include other removable / non-removable, volatile / non-volatile computer system storage media. The memory 510 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0096] The processor 520 is connected to the memory 510 and is used to execute the computer program stored in the memory 510 so that the electronic device 500 performs the WiFi forensics method.

[0097] Exemplarily, the processor 520 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. In other embodiments, the processor 520 may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0098] In some implementations, the electronic device 500 provided in the embodiment of the present application may further include a display 530. The display 530 is communicatively connected to the memory 510 and the processor 520, and is used to display a graphical user interface (GUI) related to the WiFi forensics method.

[0099] In the embodiment of the present application, the display 530 may include a display screen (display panel). In some implementations, the display panel may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. In addition, the display 530 may also be a touch panel (touch screen, touch screen), and the touch panel may include a display screen and a touch-sensitive surface. When the touch-sensitive surface detects a touch operation on or near it, it is transmitted to the processor 520 to determine the type of touch event, and then the processor 520 provides a corresponding visual output on the display device according to the type of touch event.

[0100] The present application embodiment may also provide a computer program product, the computer program product including one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer or data center.

[0101] When the computer program product is executed by a computer, the computer executes the method described in the above method embodiment. The computer program product may be a software installation package, and when the above method is required, the computer program product may be downloaded and executed on a computer.

[0102] The descriptions of the processes or structures corresponding to the above-mentioned figures have different emphases. For parts that are not described in detail in a certain process or structure, please refer to the relevant descriptions of other processes or structures.

[0103] In summary, the embodiments of the present application provide a WiFi evidence collection method, system, storage medium and electronic device. The WiFi evidence collection method releases WiFi signals by using a special router that is not connected to the external network, thereby ensuring that the device to be collected cannot automatically connect to other networks, which is beneficial to improving the accuracy of evidence collection. Compared with evidence collection devices such as computers, routers can provide faster and more stable network services, which is beneficial to improving the speed and stability of evidence collection. In addition, the router can also release multiple WiFi hotspots at the same time to achieve parallel evidence collection of multiple WiFi tasks, thereby greatly improving the efficiency of evidence collection. Therefore, the present application effectively overcomes the various shortcomings in the prior art and has a high industrial utilization value.

[0104] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.< / password> < / ssid> < / encryption> < / interfaceip> < / routerbasicip> < / interfacename>

Claims

1. A WiFi evidence collection method, characterized in that: The WiFi evidence collection method includes: The router is flashed with the OpenWrt system according to the first command received; The router performs function setting according to the received second instruction; The evidence collection device generates a WiFi hotspot based on the router, and the evidence collection device is connected to the router in a wired communication manner; The device to be collected evidence is connected to the WiFi hotspot; The evidence collection device performs WiFi evidence collection via the WiFi hotspot.

2. The WiFi evidence collection method according to claim 1, characterized in that: The router flashes the OpenWrt system according to the first command received, including: The router performs the following steps according to the received first instruction: Enter recovery mode and open the SSH connection port; Flash the native OpenWrt system and import the OpenWrt backup package.

3. The WiFi evidence collection method according to claim 1, characterized in that: The second instruction is a uci instruction.

4. The WiFi evidence collection method according to claim 3, characterized in that: The uci instructions include virtual network port creation instructions, default gateway configuration instructions, WiFi signal creation instructions, firewall rule creation instructions and / or port forwarding setting instructions.

5. The WiFi evidence collection method according to claim 1, characterized in that: The WiFi evidence collection method further includes: selecting a router mode to perform WiFi evidence collection through an evidence collection software interface of the evidence collection device.

6. The WiFi evidence collection method according to claim 1, characterized in that: The WiFi evidence collection method also includes: the evidence collection device obtains the hotspot name and password that meets the current WiFi evidence collection task and generates a QR code, and the device to be collected connects to the WiFi hotspot by scanning the QR code.

7. The WiFi evidence collection method according to claim 1, characterized in that: There are multiple WiFi hotspots, and each WiFi hotspot has at least two frequency bands.

8. A WiFi evidence collection system, characterized in that: The WiFi evidence collection system includes a router, an evidence collection device connected to the router in a wired communication manner, and a device to be collected, and is used to implement the WiFi evidence collection method described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the WiFi forensics method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device comprises: A memory storing a computer program; A processor is communicatively connected to the memory, and executes the WiFi forensics method according to any one of claims 1 to 7 when calling the computer program.

Images