Evidence obtaining method based on mirror image simulation in private cloud environment

Abstract

The invention relates to an evidence obtaining method based on mirror image simulation in a private cloud environment, and the method comprises the following steps: obtaining a target system mirror image as a source mirror image, and creating a differential mirror image of the source mirror image; the cloud computing service obtains the differential mirror image, a virtual machine is started to carry out evidence obtaining operation based on mirror image simulation, and the differential mirror image is applied to the source mirror image when the virtual machine is started, so that the evidence obtaining operation is completely recorded on the differential mirror image. According to the method, environment limitation and resource waste occurring during simulation of various types of mirror images can be avoided, the mirror image simulation efficiency is improved, isolation of the source mirror image and the simulated disk is guaranteed, and then the efficiency of evidence obtaining work and evidence safety are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic data forensics, and in particular to a forensics method based on mirror simulation in a private cloud environment. Background Art

[0002] Image simulation is a key technology for electronic data forensics. It can create a consistent copy of the investigated device to ensure the integrity and reliability of evidence, and facilitate analysis and evidence collection, backup and preservation, and isolation and protection of original evidence. Existing image simulation technologies are all based on the complete image file of the target hardware for image simulation, which has the following problems:

[0003] The local environment has low resource configuration, poor scalability, high performance overhead, and cannot support multi-person collaboration;

[0004] The simulation process needs to go through format conversion. Image format conversion usually requires re-encoding and reorganizing the image data. The data copying and compression operations during the conversion process will also increase system overhead and latency.

[0005] Any error in the image format conversion process may cause partial data loss or damage to the image file.

[0006] Therefore, image simulation for large-capacity image files is a very time-consuming process, especially in scenarios where multiple virtual machines need to be opened, and a method is needed to solve the above problem. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a forensics method based on mirror simulation in a private cloud environment, which can improve the efficiency of forensics work and the security of evidence.

[0008] The technical solution adopted by the present invention to solve the technical problem is: to provide a forensics method based on mirror simulation in a private cloud environment, comprising the following steps:

[0009] Obtaining a target system image as a source image, and creating a differential image of the source image;

[0010] The cloud computing service obtains the differential image and starts a virtual machine to perform a forensic operation based on image simulation. When the virtual machine is started, the differential image is applied to the source image so that the forensic operation is completely recorded on the differential image.

[0011] Furthermore, before the step of obtaining the differential image by the cloud computing service, the step further includes:

[0012] The created differential image is uploaded through an image storage service, and the storage path of the source image and the mount path of the source image are added to its metadata.

[0013] Furthermore, the cloud computing service obtains the differential image by adopting an image storage service to download the differential image to the cloud computing service.

[0014] Furthermore, between the step of obtaining the differential image and the step of starting the virtual machine to perform a forensic operation based on image simulation, the following steps are further included:

[0015] Reading the storage path of the source image and the mount path of the source image from the metadata of the differential image;

[0016] Check whether the source image exists according to the read information, and if so, start the virtual machine, otherwise, end the image simulation.

[0017] Furthermore, starting the virtual machine to perform a forensic operation based on image simulation includes the following steps:

[0018] The storage path of the source image is mounted to the mount path of the source image, a virtual machine is started to load the source image and the differential image is applied to the source image, and then a forensics operation based on image simulation is performed.

[0019] Furthermore, when the virtual machine is restarted, the following steps are included:

[0020] Check the mounting status of the source image, if it is mounted, restart the virtual machine, otherwise mount the storage path of the source image to the mounting path of the source image, and then restart the virtual machine.

[0021] Furthermore, linuxmounter is used to mount the source image.

[0022] Further, the creating a differential image of the source image includes:

[0023] Mounting the source image to a first path;

[0024] Create a differential image of the source image and unmount the source image.

[0025] Beneficial Effects

[0026] Due to the adoption of the above technical scheme, the present invention has the following advantages and positive effects compared with the prior art: the present invention creates a differential image of the target system image, constructs an image simulation environment using a virtual machine, applies the differential image to the source image at startup, and records the entire image simulation process on the differential image, thereby ensuring that the source image is isolated from the simulated disk, and will not affect the source image when operating the simulated virtual machine; the present invention mounts the source image through linuxmounter, and can directly read and use the mounted image in a conventional manner without converting the format; the present invention uses a private cloud as an image simulation environment, thereby avoiding the hardware device limitations of various types of images during simulation, and only smaller differential images need to be transmitted between different services, giving full play to the flexibility and automation advantages of the private cloud, and accelerating the entire simulation process; the present invention is particularly suitable for scenarios where multiple virtual machines are simultaneously started for the same source image to perform different simulation tasks, which can minimize resource waste and improve simulation efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0029] The embodiment of the present invention relates to a forensics method based on mirror simulation in a private cloud environment, such as Figure 1 As shown, the following steps are included:

[0030] 1. Prepare the source image: obtain the complete image file of the target system as the source image;

[0031] 2. Mount the source image: Based on the source image obtained in step 1, a virtual file system is created through: `linuxmounter-img source file -dest mount path`;

[0032] 3. Build a differential image: Use qemu-img to perform a differential image on the file system virtualized in step 2, and cancel the source image mount after the differential;

[0033] 4. Import differential images into private cloud: upload differential images to the cloud through the image storage service, and attach the source image's storage path and mount path information as metadata;

[0034] 5. Image initialization: Download the differential image from the image storage service to the computing service, read the source image's storage path' and 'mount path' information in the image metadata in step 4, and check whether the source image file exists according to the source image storage path. If it does not exist, the process ends, otherwise go to step 6;

[0035] 6. According to the source image storage path read in step 5, mount the source image storage path read in step 5 to the specified mount path through linuxmounter-img;

[0036] 7. Start the virtual machine: After the virtual machine starts, the source image will be loaded, and all changes after startup will be recorded through the differential image;

[0037] 8. Virtual machine restart / host downtime restart service: Check the mounting status of the source image before restarting the virtual machine. If it is not mounted, use linuxmounter to mount the source image.

[0038] 9. Multiple virtual machine services: Create multiple differential images for the same source image and download them to the computing service. After the source image is mounted, multiple virtual machines with different differential images can be started at the same time for image simulation.

Claims

1. A forensics method based on image simulation in a private cloud environment, characterized in that: The following steps are involved: Obtaining a target system image as a source image, and creating a differential image of the source image; The differential image is obtained, and a virtual machine is started to perform a forensic operation based on image simulation. When the virtual machine is started, the differential image is applied to the source image, so that the forensic operation is completely recorded on the differential image.

2. The method according to claim 1, characterized in that Before the step of obtaining the differential image by the cloud computing service, the step further includes: The created differential image is uploaded through an image storage service, and the storage path of the source image and the mount path of the source image are added to its metadata.

3. The method according to claim 2, characterized in that The cloud computing service obtains the differential image by adopting an image storage service to download the differential image to the cloud computing service.

4. The method according to claim 2, characterized in that: Between the step of obtaining the differential image and the step of starting the virtual machine to perform a forensic operation based on image simulation, the following steps are also included: Reading the storage path of the source image and the mount path of the source image from the metadata of the differential image; Check whether the source image exists according to the read information, and if so, start the virtual machine, otherwise, end the image simulation.

5. The method according to claim 2, characterized in that: The step of starting the virtual machine to perform a forensic operation based on image simulation includes the following steps: The storage path of the source image is mounted to the mount path of the source image, a virtual machine is started to load the source image and the differential image is applied to the source image, and then a forensics operation based on image simulation is performed.

6. The method according to claim 5, characterized in that When restarting the virtual machine, the following steps are included: Check the mounting status of the source image, if it is mounted, restart the virtual machine, otherwise mount the storage path of the source image to the mounting path of the source image, and then restart the virtual machine.

7. The method according to claim 6, characterized in that The source image is mounted using linuxmounter.

8. The method according to claim 1, characterized in that The step of creating a differential image of the source image comprises: Mounting the source image to a first path; Create a differential image of the source image and unmount the source image.

Images