Mobile device evidence obtaining method and system, medium and electronic device

Abstract

The invention provides a mobile device evidence obtaining method and system, a medium and an electronic device. The method comprises the following steps: obtaining a system version carried by a mobile device to be subjected to evidence obtaining; performing identification based on the system version to respond to a corresponding evidence obtaining mechanism, if the system version is located in a first range, performing a first evidence obtaining response, and if the system version is located in a second range, performing a second evidence obtaining response; the first range and the second range specifically refer to version model ranges of system versions carried by the mobile equipment; based on the target script, skipping the evidence collection limit of the to-be-evidence-collected device; and performing evidence obtaining transmission on the target data based on a preset transmission mechanism, wherein the target data comprises character string data and file data. According to the mobile device evidence obtaining method and system, the medium and the electronic device, during application, the evidence obtaining experience the same as that of Android mobile phone equipment which is not limited in front of an Android / data directory can be obtained without excessive additional operation, and data loss is avoided while the evidence obtaining efficiency is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile device evidence collection, and in particular relates to a mobile device evidence collection method, system, medium and electronic equipment. Background Art

[0002] With the development of the times, the widespread promotion and use of mobile devices have already made them an indispensable part of our daily lives. As the frequency of use of mobile devices increases, the collection of evidence from mobile phones is also a critical part of the case. Mobile phones store photos, audio and video, application chat records and usage information taken by users. Extracting this data will be of great help to the case.

[0003] For mobile devices running the Android system, the resource data extraction solution usually involves installing a forensic app on the phone. The app then uses the data interface provided by Google to collect and send mobile phone data. In actual application, the forensic process is hindered due to limitations of different system versions. Summary of the invention

[0004] The purpose of the present invention is to provide a mobile device evidence collection method, system, medium and electronic device, which are used to solve the problem that the existing mobile device evidence collection method is restricted by the system version and the evidence collection process is blocked.

[0005] In a first aspect, the present invention provides a method for obtaining evidence from a mobile device, the method comprising the following steps:

[0006] Obtain the system version of the mobile device to be used for evidence collection;

[0007] Based on the system version, identification is performed to respond to the corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version installed on the mobile device; wherein,

[0008] Skipping the evidence collection limitation of the device to be collected based on a preset target script; and

[0009] The target data is forensically transmitted based on a preset transmission mechanism, wherein the target data includes string data and file data.

[0010] In a possible implementation of the present application, obtaining the system version of the device to be evidenced includes:

[0011] Acquire the system properties corresponding to the device to be evidenced with which the communication connection is established;

[0012] Version identification is performed based on the system attribute to obtain the system version, wherein the system version includes a first version, a second version, and an invalid version.

[0013] In a possible implementation of the present application, the identification based on the system version to respond to the corresponding evidence collection mechanism specifically includes:

[0014] The first version is within the first range, and the first evidence collection response is performed, which specifically includes installing an evidence collection application, empowering evidence collection, actively collecting evidence, and ending evidence collection;

[0015] The second version is within the second range, and the second evidence collection response is performed, which specifically includes installing an evidence collection application, empowering evidence collection, passive evidence collection, and ending evidence collection;

[0016] If the invalid version is within the invalid range, no forensic response is performed and an error reminder is output.

[0017] In a possible implementation of the present application, during the evidence collection, the evidence collection limitation of the device to be collected is skipped based on a preset target script, specifically including:

[0018] When performing the forensic authorization, the target script is called based on the execution instruction, wherein the target script includes a Shell script;

[0019] Starting a target file based on the target script to create a target process, wherein the target process has Shell permissions;

[0020] The target instruction is executed in the target process to skip the forensic limitation of the device to be forensically acquired, wherein the target instruction includes app_process.

[0021] In a possible implementation of the present application, the active evidence collection specifically includes: after skipping the evidence collection authority, the first version of the device to be collected actively extracts data in the device to be collected to complete the evidence collection operation.

[0022] In a possible implementation of the present application, the passive evidence collection specifically includes: after skipping the evidence collection permission, the second version of the device to be collected passively extracts the data in the device to be collected by obtaining the evidence collection response from the user end to complete the evidence collection operation.

[0023] In a possible implementation of the present application, during the evidence collection, the target data is transmitted for evidence collection based on a preset transmission mechanism, specifically including:

[0024] For the string data, creating a temporary file in the forensic application to store the string data;

[0025] For the file data, the forensic application uses socket bidirectional communication to transmit file descriptors.

[0026] In a second aspect, the present invention provides a mobile device evidence collection system, the system comprising:

[0027] The acquisition module is used to obtain the system version of the device to be forensically acquired;

[0028] a response module, configured to identify based on the system version to respond to a corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version carried by the mobile device;

[0029] The forensic module is used to skip the forensic limitations of the device to be forensically collected based on a preset target script; and to perform forensic transmission of target data based on a preset transmission mechanism, wherein the target data includes string data and file data.

[0030] In a third aspect, the present invention provides an electronic device, the electronic device comprising: a processor and a memory;

[0031] The memory is used to store computer programs;

[0032] The processor is used to execute the computer program stored in the memory so that the electronic device executes the above-mentioned mobile device evidence collection method.

[0033] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned mobile device evidence collection method when executed by an electronic device.

[0034] As described above, the mobile device forensics method, system, medium and electronic device described in the present invention have the following beneficial effects: by enabling the privilege escalation service, the forensics App with elevated privileges sends a request instruction to the transit service, and the transit service performs file browsing, file extraction, authorization and other operations according to the instruction type, and sends the acquired data back to the forensics App. In the actual forensics scenario, investigators do not need to perform too many additional operations to obtain the same forensics experience as the mobile phone before the Android / data directory is restricted, thereby ensuring the efficiency of forensics while avoiding data loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 Shown is a schematic diagram of a scene of an electronic device in an embodiment of the present invention;

[0036] Figure 2Shown is a schematic diagram of steps in an embodiment of a mobile device evidence collection method of the present invention;

[0037] Figure 3 Shown is a schematic diagram of steps in an embodiment of a mobile device evidence collection method of the present invention;

[0038] Figure 4 Shown is a flow chart of a mobile device evidence collection method in one embodiment of the present invention;

[0039] Figure 5 Shown is a flow chart of a mobile device evidence collection method in one embodiment of the present invention;

[0040] Figure 6 Shown is a flow chart of a mobile device evidence collection method in one embodiment of the present invention;

[0041] Figure 7 Shown is a schematic diagram of steps in an embodiment of a mobile device evidence collection method of the present invention;

[0042] Figure 8 Shown is a schematic diagram of steps in an embodiment of a mobile device evidence collection method of the present invention;

[0043] Fig. 9 Shown is a schematic diagram of the structure of a mobile device evidence collection system in one embodiment of the present invention;

[0044] Fig.10 It is a schematic structural diagram of an electronic device of the present invention in one embodiment. DETAILED DESCRIPTION

[0045] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0046] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0047] The following embodiments of the present invention provide a method for obtaining evidence from a mobile device, which can be applied to: Figure 1The electronic device shown. The electronic device described in the present invention may include a mobile phone with wireless charging function, a tablet computer, a laptop computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present invention does not impose any restrictions on the specific type of the electronic device.

[0048] For example, the electronic device may be a station (STAION, ST) in a WLAN with a wireless charging function, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with a wireless charging function, a computing device or other processing device, a computer, a laptop computer, a handheld communication device, a handheld computing device, and / or other devices for communicating on a wireless system and a next generation communication system, such as a mobile terminal in a 5G network, a mobile terminal in a future evolved Public Land Mobile Network (PLMN), or a mobile terminal in a future evolved Non-terrestrial Network (NTN).

[0049] For example, the electronic device can communicate with the network and other devices through wireless communication. The above wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobilecommunication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS can include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS) and / or Satellite Based Augmentation Systems (SBAS).

[0050] The technical solutions in the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0051] Specifically, see Figure 2 In one embodiment of the invention, the mobile device evidence collection method of the present invention comprises the following steps:

[0052] Step S202, obtaining the system version of the mobile device to be used for evidence collection;

[0053] Step S204, performing identification based on the system version to respond to a corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version installed on the mobile device;

[0054] Step S206, skipping the evidence collection limitation of the device to be collected based on a preset target script;

[0055] Step S208, performing forensic transmission on the target data based on a preset transmission mechanism, wherein the target data includes string data and file data.

[0056] It should be noted that in this embodiment, Google has been controlling the storage access rights of program applications (App) and mobile phones in recent years. Starting from Android 11, file management of the Android / data directory requires additional manual authorization before it can be used. Android 13 requires additional manual authorization for each Android / data directory until the authorization method is officially closed on the phone with Android security patches and new versions of file apps installed. In this case, it will be more difficult for the mobile phone to obtain data under the Android / data directory. This directory is mainly used to manage data and resource files of various APPs, such as WeChat and QQ chat records and the corresponding pictures, audio and video. The inability to extract these data will greatly affect the results of forensics.

[0057] Therefore, different systems installed on Android devices correspond to different forensic mechanisms, so we must first obtain the system version of the device to be collected, specifically by obtaining the system properties corresponding to the device to be collected that establishes a communication connection, and then identifying the corresponding system version based on the system properties, and then identifying based on the system version to respond to different forensic mechanisms in a targeted manner. If the system version is within the first range, specifically the system version is greater than Android 7 and less than or equal to Android 11, a first forensic response is made; if the system version is within the second range, specifically the system version is greater than Android 11, a second forensic response is made. The first range and the second range specifically refer to the version model range of the system version installed on the mobile device, and when collecting evidence, the forensic limitations of the device to be collected are skipped based on the preset target script, and the target data is transmitted forensically based on the preset transmission mechanism. The subsequent instructions will describe in detail how to skip permissions and how to transmit evidence.

[0058] Further, in one embodiment of the invention, if Figure 3 As shown, the identification based on the system version to respond to the corresponding evidence collection mechanism specifically includes the following steps:

[0059] Step S302: the first version is within the first range, and the first evidence collection response is performed, which specifically includes installing an evidence collection application, granting evidence collection rights, actively collecting evidence, and ending evidence collection;

[0060] Step S304: the second version is within the second range, and the second evidence collection response is performed, which specifically includes installing an evidence collection application, granting evidence collection rights, passive evidence collection, and ending evidence collection;

[0061] Step S306: if the invalid version is within the invalid range, no evidence collection response is performed and an error reminder is output.

[0062] It should be noted that, in this embodiment, Figure 4 As shown, the system version includes a first version, a second version and an invalid version, and the corresponding version ranges include a first range, a second range and an invalid range, wherein the first range specifically refers to a system version greater than Android 7 and less than or equal to Android 11, and the second range specifically refers to a system version greater than Android 11. Correspondingly, the invalid range corresponds to a system version less than or equal to Android 7. The present invention specifically applies the Adb command to call a Shell script to execute skip permissions. Therefore, this method is not applicable to Android 7 and below. Therefore, when the identified system version is an invalid version, no forensic response is performed, and an error reminder is output to remind the user that the current version is too low and the current forensic method is not applicable.

[0063] Further, the identified system version is within the first range, corresponding to the first version, and a first forensic response is performed, which specifically includes installing a forensic application, granting forensic authority, actively collecting forensics, and ending forensics. The identified system version is within the second range, corresponding to the second version, and a second forensic response is performed, which specifically includes installing a forensic application, granting forensic authority, passively collecting forensics, and ending forensics. Specifically, refer to Figure 5 It can be seen that for the present invention, when it is specifically executed, first of all, the system version is greater than Android7. Secondly, after installing the evidence collection application (forensic App) and granting evidence, there is a fork, which corresponds to different evidence collection responses. Among them, the system version is greater than Android7 and less than or equal to Android11, and active evidence collection is the first evidence collection response. The system version is greater than Android11, and passive evidence collection is the second evidence collection response. If the identified system version is less than or equal to Android7, it indicates that the current version is an invalid version. Among them, after installing the evidence collection App, the present invention uses the Adb command to open a permission escalation service on the mobile phone. The service will run on the mobile phone and indirectly allow the evidence collection App to obtain Shell permissions as a transfer station. The evidence collection App with elevated permissions sends a request instruction to the transfer service. The transfer service will perform file browsing, file extraction, authorization and other operations according to the instruction type, and send the acquired data back to the evidence collection App. In the actual evidence collection environment, the case handler does not need to perform too many additional operations to get the same evidence collection experience as the mobile phone before the Android / data directory is restricted.

[0064] Specifically, Figure 6As shown, the active evidence collection specifically includes: after the first version of the device to be collected skips the evidence collection authority, the device to be collected actively extracts the data in the device to be collected to complete the evidence collection operation; and the passive evidence collection specifically includes: after the second version of the device to be collected skips the evidence collection authority, the device to be collected passively extracts the data in the device to be collected to complete the evidence collection operation by obtaining the evidence collection response from the user end.

[0065] It should be noted that in this embodiment, for active evidence collection, the device to be collected has a system version greater than Android 7 and less than or equal to Android 11. After skipping the forensic permission, the data in the device to be collected is actively extracted to complete the forensic operation. Specifically, the authorization API officially provided by Google is used to directly authorize all permissions of the forensic App. The code is as follows:

[0066] " / **

[0067] * Permission granting logic

[0068] *@param packageName the name of the application package to be authorized

[0069] *@param permission The name of the permission to be granted

[0070] *@param userId user ID (usually 0)

[0071] * @throws RemoteException

[0072] * /

[0073] @Override

[0074] public void grantPermission(String packageName,String permission,intuserId)throws RemoteException{

[0075] IPackageManager.Stub.asInterface(SystemServiceHelper.getSystemService("package")).grantRunti mePermission(packageName,permission,userId);

[0076] }”

[0077] As for passive forensics, for devices with system versions greater than Android 11, after they skip the forensics permissions, data in the devices are passively extracted to complete the forensics operation. Specifically, data extraction is performed by obtaining the forensics response from the user side, which means that for devices with system versions greater than Android 11, a pop-up window will be generated for user confirmation, and data forensics extraction can only be performed after the user confirms.

[0078] Further, in one embodiment of the invention, if Figure 7 As shown, during the evidence collection, the evidence collection setting limit of the device to be collected is skipped based on a preset target script, which specifically includes the following steps:

[0079] Step S702, when performing the forensic authorization, calling the target script based on the execution instruction, wherein the target script includes a Shell script;

[0080] Step S704, starting the target file based on the target script to create a target process, wherein the target process has Shell permissions;

[0081] Step S706, executing a target instruction in the target process to skip the forensic limitation of the device to be forensically collected, wherein the target instruction includes app_process.

[0082] It should be noted that, in this embodiment, how to perform the forensic authorization to skip the forensic permission is specifically explained, wherein the permission escalation service is specifically applied, firstly, the instruction is executed to call the target script, and the executed execution instruction corresponds to the Adb_Shell instruction, wherein the target script includes a Shell script, and a Shell script stored in the forensic App directory is specifically executed, and further, the target file is started based on the target script to create a target process, wherein the target file is a prefixed ".so" file, and accordingly, after starting the target file, a target process with Shell permission will be created, and finally, the target instruction is run in the target process that already has Shell permission to skip the forensic limitation of the device to be obtained, wherein the target instruction includes app_process, wherein app_process is a core tool in the Android system, which is used to start applications and background services, and in this embodiment, it is to run the permission escalation service to achieve the purpose of skipping the forensic limitation of the device to be obtained.

[0083] Furthermore, in one embodiment of the invention, during the forensics, the target data is forensically transmitted based on a preset transmission mechanism, such as Figure 8 As shown, the specific steps include:

[0084] Step S802, for the string data, creating a temporary file in the forensic application to store the string data;

[0085] Step S804: for the file data, using socket bidirectional communication based on the forensic application to transmit the file descriptor.

[0086] It should be noted that, in this embodiment, after the privilege escalation, the forensic App and the privilege escalation service can perform data transmission through the traditional Binder, and Binder can only transmit "1MB-8KB" at most in one communication, which is very slow for forensics and cannot perform large-scale transmission at one time, which will cause serious problems such as data loss. Therefore, in this embodiment, it is clearly stated that the target data is forensically transmitted based on a preset transmission mechanism, wherein the target data includes string data and file data, wherein, for the string data, a temporary file is created in the forensic application to store the string data; for the file data, the file descriptor is transmitted based on the forensic application using socket two-way communication.

[0087] Specifically, for string data, a temporary file is created in the forensic application to store the string data. For example, if a large amount of text needs to be transmitted (such as a json format string of all file data in a folder), a temporary file will be created in the directory of the forensic app and the data will be written. Then the privilege escalation service will pass the file location to the forensic app, and the forensic app will read the desired data from the file. The specific code is as follows: What function is used to do what

[0088]

[0089] Furthermore, for file data, the forensic application uses socket bidirectional communication to transmit file descriptors. For example, if a large file needs to be transmitted, Parcel-File-Descriptor is used to transmit only the file descriptor, and the forensic App directly uses Socket to connect with it for transmission. Socket is an abstract layer through which the application can send or receive data, and can perform operations such as opening, reading, writing and closing on it like a file. The code is as follows:

[0090]

[0091] Furthermore, by targeted processing of the string data and file data in this embodiment, the problem of small Binder transmission volume can be solved. In addition, compared with the prior art, the present invention has the following beneficial effects:

[0092] Compared with the MTP extraction scheme: the MTP scheme needs to scan each layer of the directory in the mobile phone, and only extract after finding the required files, which takes a lot of time. The scheme of the present invention can be accessed using the native interface, and does not need to be scanned layer by layer. And, compared with the Adb pull command for extraction: sometimes the name of the extracted directory does not meet the standard when the Adb pull command is used, which causes the entire extraction to be terminated, and the normal files that may exist later will not continue. The present invention will be refined to extract according to the file. If there are files that cannot be extracted, the subsequent files will continue to be extracted. And, the present invention is a Shell promotion method of the original App extraction scheme. Its basic operation is very different from the original one. The case handler does not need too many additional operations. With the simulated click scheme, it can realize active permission promotion and data extraction. And, since the forensic App obtains the Shell permission, it can also use other system-level interfaces except data extraction. If it is an Android 11 version or earlier mobile phone, the Shell permission can be directly used. The permission granting interface directly grants all permissions to the forensic App, skipping the self-authorization loop saves a lot of time for active authorization.

[0093] The embodiments of the present application also provide a mobile device forensics system, which can implement the mobile device forensics method described in the present application. However, the implementation device of the mobile device forensics method described in the present application includes but is not limited to the structure of the mobile device forensics system listed in the embodiments. All structural deformations and replacements of the prior art made according to the principles of the present application are included in the protection scope of the present application.

[0094] See also Fig. 9 In one embodiment, this embodiment provides a mobile device evidence collection system 90, the system comprising:

[0095] An acquisition module 91 is used to acquire the system version of the device to be acquired;

[0096] A response module 92 is used to identify based on the system version to respond to a corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version installed on the mobile device;

[0097] The evidence collection module 93 is used to skip the evidence collection limit of the device to be collected based on a preset target script; and to perform evidence collection transmission on the target data based on a preset transmission mechanism, wherein the target data includes string data and file data.

[0098] It should be noted that the acquisition module 91 is used to obtain the system version of the device to be collected, specifically by obtaining the system properties corresponding to the device to be collected with which a communication connection is established, and then performing version identification based on the system properties to obtain the system version. Accordingly, the system version includes a first version, a second version, and an invalid version, wherein the system range of the first version corresponds to a system version greater than Android 7 and less than or equal to Android 11, the system range of the second version corresponds to a system version greater than Android 11, and the system range of the invalid version corresponds to a system version less than or equal to Android 7.

[0099] The response module 92 is used to identify based on the system version to respond to the corresponding forensic mechanism, wherein if the system version is within the first range, a first forensic response is performed, and if the system version is within the second range, a second forensic response is performed. Specifically, the first forensic response specifically includes installing a forensic application, empowering forensics, active forensics, and ending forensics, and the second forensic response specifically includes installing a forensics application, empowering forensics, passive forensics, and ending forensics. The difference between the first and second forensic responses lies in "active forensics" and "passive forensics". Since the system range of the first version corresponds to a system version greater than Android 7 and less than or equal to Android 11, evidence can be actively collected during specific evidence collection. The system range of the second version corresponds to a system version greater than Android 11, and it is impossible to actively collect evidence directly. Data extraction can only be performed after obtaining the forensic response from the user end, so it is called "passive forensics".

[0100] The evidence collection module 93 is used to skip the evidence collection limit of the device to be collected based on a preset target script during evidence collection, and to perform evidence collection transmission on the target data based on a preset transmission mechanism during evidence collection. In the process of authorization for evidence collection, a Shell script is specifically called as the target script, and a target file is started based on the target script to create a target process with Shell authority. Finally, the forensic limit of the device to be collected is skipped by the app_process instruction in the target process that already has Shell authority. In addition, during evidence collection, there are two ways to transmit the target data, which are determined according to the type of the target data. Specifically, for string data, a temporary file is created in the forensic application to store the string data. For string data, for example, when a large amount of text needs to be transmitted (such as a json format string of all file data in a folder), a temporary file will be created in the directory of the forensic app and the data will be written. Then the privilege escalation service will pass the file location to the forensic app, and the forensic app will read the desired data from the file. For string data, a temporary file will be created in the forensic application to store the string data. For example, when a large amount of text needs to be transmitted (such as a json format string of all file data in a folder), a temporary file will be created in the directory of the forensic app and the data will be written. Then the privilege escalation service will pass the file location to the forensic app, and the forensic app will read the desired data from the file.

[0101] Since the specific implementation of this embodiment corresponds to the aforementioned method embodiment, the same details will not be repeated here, and those skilled in the art should also understand that Fig. 9 The division of the modules in the embodiment is merely a division of logical functions, and in actual implementation, all or part of them can be integrated into one or more physical entities, and these modules can be implemented entirely in the form of software called by processing elements, or entirely in the form of hardware, or some modules can be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware.

[0102] In the several embodiments provided by the present invention, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules / units is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules or units, which can be electrical, mechanical or other forms.

[0103] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. For example, the functional modules / units in the various embodiments of the present invention may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0104] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0105] The embodiment of the present invention also provides a computer-readable storage medium. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by instructing the processor through a program, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state disk (SSD)), etc.

[0106] An embodiment of the present invention further provides an electronic device, which includes a processor and a memory.

[0107] The memory is used to store computer programs.

[0108] The memory includes: ROM, RAM, disk, USB flash drive, memory card or CD and other media that can store program codes.

[0109] The processor is connected to the memory and is used to execute the computer program stored in the memory so that the electronic device executes the above-mentioned mobile device evidence collection method.

[0110] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0111] like Fig.10 As shown, the electronic device of the present invention is in the form of a general computing device. The components of the electronic device may include but are not limited to: one or more processors or processing units 101, a memory 102, and a bus 103 connecting different system components (including the memory 102 and the processing unit 101).

[0112] Bus 103 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0113] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0114] The memory 102 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1021 and / or cache memory 1022. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1023 may be used to read and write non-removable, non-volatile magnetic media ( Fig.10 not shown, usually called a "hard drive"). Although Fig.10 Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 103 via one or more data medium interfaces. The memory 102 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0115] A program / utility 1024 having a set (at least one) of program modules 10241 may be stored, for example, in the memory 102, such program modules 10241 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 10241 generally perform the functions and / or methods of the embodiments described herein.

[0116] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via input / output (I / O) interface 104. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 105. Fig.10 As shown, the network adapter 105 communicates with other modules of the electronic device via the bus 103. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0117] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A method for obtaining evidence from a mobile device, characterized in that: include: Obtain the system version of the mobile device to be used for evidence collection; Based on the system version, identification is performed to respond to the corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version installed on the mobile device; wherein the evidence collection limit of the device to be collected is skipped based on a preset target script; and The target data is forensically transmitted based on a preset transmission mechanism, wherein the target data includes string data and file data.

2. The mobile device evidence collection method according to claim 1, characterized in that: The step of obtaining the system version of the device to be evidenced specifically includes: Acquire the system properties corresponding to the device to be evidenced with which the communication connection is established; Version identification is performed based on the system attribute to obtain the system version, wherein the system version includes a first version, a second version, and an invalid version.

3. The mobile device evidence collection method according to claim 2, characterized in that: The identifying based on the system version to respond to the corresponding evidence collection mechanism specifically includes: The first version is within the first range, and the first evidence collection response is performed, which specifically includes installing an evidence collection application, empowering evidence collection, actively collecting evidence, and ending evidence collection; The second version is within the second range, and the second evidence collection response is performed, which specifically includes installing an evidence collection application, empowering evidence collection, passive evidence collection, and ending evidence collection; If the invalid version is within the invalid range, no forensic response is performed and an error reminder is output.

4. The mobile device evidence collection method according to claim 3, characterized in that: During the evidence collection, the evidence collection setting limit of the device to be collected is skipped based on a preset target script, specifically including: When performing the forensic authorization, the target script is called based on the execution instruction, wherein the target script includes a Shell script; Starting a target file based on the target script to create a target process, wherein the target process has Shell permissions; The target instruction is executed in the target process to skip the forensic limitation of the device to be forensically acquired, wherein the target instruction includes app_process.

5. The mobile device evidence collection method according to claim 4, characterized in that: The active evidence collection specifically includes: after skipping the evidence collection authority, the first version of the device to be collected actively extracts data in the device to be collected to complete the evidence collection operation.

6. The mobile device evidence collection method according to claim 4, characterized in that: The passive evidence collection specifically includes: after skipping the evidence collection permission, the second version of the device to be collected passively extracts the data in the device to be collected by obtaining the evidence collection response from the user end to complete the evidence collection operation.

7. The mobile device evidence collection method according to claim 4, characterized in that: During the forensics, the target data is forensically transmitted based on a preset transmission mechanism, specifically including: For the string data, creating a temporary file in the forensic application to store the string data; For the file data, the forensic application uses socket bidirectional communication to transmit file descriptors.

8. A mobile device evidence collection system, characterized in that: include: The acquisition module is used to obtain the system version of the device to be forensically acquired; a response module, configured to identify based on the system version to respond to a corresponding evidence collection mechanism, wherein if the system version is within a first range, a first evidence collection response is performed, and if the system version is within a second range, a second evidence collection response is performed; the first range and the second range specifically refer to the version model range of the system version carried by the mobile device; The forensic module is used to skip the forensic limitations of the device to be forensically collected based on a preset target script; and to perform forensic transmission of target data based on a preset transmission mechanism, wherein the target data includes string data and file data.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the mobile device evidence collection method described in any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the electronic device executes the mobile device forensics method as described in any one of claims 1 to 7.

Images