Method for tracing evidence chain for AirDrop

Abstract

The invention discloses a method for tracing an evidence chain aiming at AirDrop. The method is characterized by comprising the following steps of S100, generating and summarizing system logs of an iPhone mobile phone of a receiving end; s200, the system log is decompressed; s300, searching the decompressed system log, obtaining evidence chain information, obtaining a sending end iPhone mobile phone name, an AirDrop ID, a sent file storage path in the sending end, the number of sent files, a sent file name and a sent file type, and obtaining a task ID, an AirDrop ID and a file temporary storage path of a receiving end iPhone mobile phone; and S400, for the obtained log of the receiving end iPhone mobile phone, corresponding data in the log of the sending end iPhone mobile phone system and a closed-loop chain used for calibrating evidence traceability are obtained, and the corresponding data comprise the name of the receiving end iPhone mobile phone, the AirDrop ID, a sent file storage path in the sending end, the number of sent files, the names of the sent files and the types of the sent files.

Description

Technical Field

[0001] The present invention belongs to the field of electronic evidence collection, and relates to a method for collecting evidence from usage traces of iPhone mobile phone users, and in particular to a method for tracing the evidence chain for AirDrop. Background Art

[0002] There are many iPhone users today. While iPhone brings convenience to users' lives, it also brings troubles to society and the public. This is mainly reflected in the following: some criminals use the convenient AirDrop function of iPhone to post pornographic, obscene, reactionary, and privacy-invading pictures, files, videos, etc. in crowded places, or post Internet virus programs, various files and apps for profit or fraud.

[0003] How to use a used iPhone to accurately verify the iPhone user's usage traces in a convenient way has become an urgent problem that needs to be solved in electronic forensics.

[0004] Among them, regarding iPhone user usage traces, AirDrop evidence collection for iPhone phones has many shortcomings in the existing technologies in the electronic evidence collection industry: for example, it is necessary to fix the crowd / suspects in a small area; or, if the person leaves, it will be impossible to fix the historical crowd / suspects for a certain degree of analysis and processing. Specifically, the existing technologies have the following disadvantages:

[0005] 1. It is not efficient to copy all the AirDrop data of the iPhone; or when the people present leave or turn off AirDrop, it is impossible to find all the historical people / suspects and the files they sent, which increases the difficulty of evidence collection.

[0006] 2. Insufficient data analysis capabilities: For a certain file, the analysis results often fail to meet the requirements of forensics, and it is difficult to find the correlation between the sender and the receiver.

[0007] 3. The analysis results are not accurate enough.

[0008] 4. The operation process is extremely complicated and requires the collaboration of professional personnel to complete the evidence collection work.

[0009] In summary, a method to trace the iPhone AirDrop evidence chain / mobile phone behavior that is easy to operate, efficient in evidence collection, and accurate in analysis results is urgently needed.

[0010] In the prior art, there is no method for tracing the evidence chain for AirDrop. Summary of the invention

[0011] This application aims to solve the technical problems of the prior art and provide a method for tracing the evidence chain of AirDrop. The method provided by this application includes the following steps:

[0012] S100: Generate and summarize the system log of the receiving iPhone;

[0013] S200: decompressing the system log;

[0014] S300: Searching for the decompressed system log and obtaining evidence chain information includes the following steps:

[0015] S301: Search the decompressed system log, obtain the AirDrop communication connection log and obtain the name of the sender's iPhone, the AirDrop ID, and obtain the task ID and temporary file storage path of the receiver's iPhone;

[0016] S302: Search the decompressed system log to determine whether an abnormal interruption occurs during the AirDrop process. If so, execute step S303; otherwise, execute step S304;

[0017] S303: Search the decompressed system log, obtain the information about AirDrop being closed due to abnormal interruption in the log of the AirDrop communication connection, obtain the name of the sender's iPhone, AirDropID, and the storage path, number, name, and type of the sent files on the sender, so as to calibrate the closed-loop chain of evidence tracing during the abnormal interruption, and execute step S307;

[0018] S304: Search the decompressed system log to determine whether the user chooses to accept the AirDrop process. If yes, execute step S305. Otherwise, it indicates that the user chooses to reject the AirDrop process, and execute step S306.

[0019] S305: Search the decompressed system log, obtain the data transfer log and obtain the type title, storage link address, task object address, and task ID of the AirDrop data;

[0020] S306: Search the decompressed system log, obtain the log of clearing the cache, confirm that the current AirDrop is completed and check the task ID. The corresponding path of the cleared cache is the same as the temporary storage path of the file on the receiving iPhone;

[0021] S307: Output the evidence chain information obtained in the AirDrop process, including the names of the iPhone phones of the sender and the receiver, AirDrop ID, process name, date / time, as well as the storage path of the sent files, the number of sent files, the names of the sent files, the types of the sent files, and the temporary storage path of the files of the receiver's iPhone;

[0022] S400: With respect to the obtained log of the receiving iPhone, the corresponding data in the system log of the sending iPhone is obtained to calibrate the closed-loop chain of evidence tracing, wherein the corresponding data includes the name of the receiving iPhone, the AirDrop ID, and the storage path of the sent files, the number of sent files, the name of the sent files, and the type of the sent files in the sending end.

[0023] Preferably, step S100 includes the following steps:

[0024] S101: Both the receiving and sending iPhones are installed with the profile certificate officially provided by Apple;

[0025] S102: After the profile certificate is installed, restart the phone;

[0026] S103: trigger and generate system log;

[0027] S104: Waiting for a first period of time to complete the generation of the iPhone mobile phone system log;

[0028] S105: Upload the generated system log to the computer.

[0029] Preferably, step S103 includes the following steps:

[0030] Press and hold the up and down volume buttons and the side button / top button at the same time for more than 1 second. When the iPhone vibrates, release the buttons. The iPhone will trigger and generate a system log.

[0031] Preferably, the first duration is not less than 10 minutes.

[0032] Preferably, in step S306, determining that the current AirDrop is completed and checking the task ID includes the following steps:

[0033] The paired messages of the start of the task object address and the end of the task object address are used as marks to divide the current AirDrop message body, and the system log between the start of the task object address and the end of the task object address is used as the current AirDrop message body to obtain the evidence chain information.

[0034] Preferably, as an optional method for determining the current AirDrop message body, a unique task ID corresponding to the current AirDrop is used to filter the current AirDrop message body.

[0035] The present invention has the following beneficial effects:

[0036] 1. No additional hardware equipment is required, the operation is convenient, the evidence collection efficiency is high, the analysis results are accurate, and the cost is low.

[0037] 2. The technical problem that there is no method for tracing the evidence chain of AirDrop in the prior art has been solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a method for AirDrop traceability evidence chain provided by the present invention;

[0039] Figure 2 It is a screenshot of the relevant process of establishing a communication connection between the sender and the receiver in an embodiment of the present invention;

[0040] Figure 3 It is a screenshot of the process of searching for the name of the iPhone phone at the sending end in the embodiment of the present invention;

[0041] Figure 3A It is a screenshot of the process of searching for the temporary storage path of files on the receiving end iPhone in an embodiment of the present invention;

[0042] Figure 4 is a screenshot of a process related to AirDrop being closed due to abnormal interruption in an embodiment of the present invention;

[0043] Figure 5 It is a screenshot of the relevant process of whether the user chooses to accept / reject the AirDrop process in the embodiment of the present invention;

[0044] FIG. 6A to FIG. 6C It is a screenshot of the relevant process of data transfer in an embodiment of the present invention;

[0045] Figure 7 is a screenshot of the relevant process of clearing the cache in an embodiment of the present invention;

[0046] Figure 8 It is a screenshot of the relevant process of the end of the task object address in the embodiment of the present invention;

[0047] Fig. 9A , Fig. 9B It is a screenshot of the relevant process of the system log of the iPhone mobile phone at the sending end in the embodiment of the present invention. DETAILED DESCRIPTION

[0048] The definitions of terms that may be used in this application are as follows:

[0049] User behavior: that is, user usage traces, including user usage behavior through AirDrop on iPhone, such as sending pictures and files.

[0050] Profile: An installation certificate for a network system provided by Apple;

[0051] AirDrop: The airdrop function of iPhone, also known as AirDrop.

[0052] The present invention is described using the operating system of iOS14 as an embodiment. The scenario of the embodiment is: the sending end iPhone uses AirDrop to send a picture to the receiving end iPhone.

[0053] Figure 1 A flow chart of a method for AirDrop traceability evidence chain provided by the present invention is shown.

[0054] like Figure 1 As shown, the method includes the following steps:

[0055] S100: Generate and summarize the system log of the receiving iPhone;

[0056] Step S100 is to generate and summarize system logs, including the following steps:

[0057] S101: Both the receiving and sending iPhones are installed with the profile certificate officially provided by Apple;

[0058] S102: After the profile certificate is installed, restart the phone;

[0059] S103: The following steps may be used to trigger and generate a system log:

[0060] Press and hold the up and down volume buttons and the side button / top button at the same time for more than 1 second. When the iPhone vibrates, release the buttons. The iPhone will trigger and generate a system log.

[0061] S104: Wait for 10 minutes to complete the generation of the iPhone mobile phone system log;

[0062] S105: Upload the generated system log to the Mac computer.

[0063] You can use the AirDrop function to drop the generated system logs from your iPhone to your Mac.

[0064] S200: decompressing the system log;

[0065] The default compression format of Apple is tar.gz. As one of the decompression methods, this embodiment uses the decompression tool provided by Apple to perform decompression.

[0066] S300: Searching for the decompressed system log and obtaining evidence chain information includes the following steps:

[0067] S301: Search for the decompressed system log, obtain the AirDrop communication connection log and obtain the name of the sender's iPhone, the AirDrop ID, and obtain the task ID and temporary file storage path of the receiver's iPhone.

[0068] Specifically, search for the decompressed system log from the decompressed file. The default system log file name is system_logs.logarchive.

[0069] In this embodiment, the "Console App" of a Mac computer is used to search and analyze the system log: On a Mac computer, double-click the system log system_logs.logarchive to open it.

[0070] Use the process name filtering method to search for the process name keyword "sharingd" to filter and obtain AirDrop-related processes. Among them, pay attention to the line of log "New AirDrop connection". Because the same iPhone can only perform one AirDrop task at a time, and during each AirDrop process, the sender and receiver will establish a communication connection. The system log of "NewAirDrop connection" is the sign of establishing a communication connection.

[0071] Figure 2 FIG. 1 shows a screenshot of the relevant process of establishing a communication connection between the sender and the receiver in one embodiment of the present invention. Figure 2 As shown, “New AirDrop connection 0x102d41900” is the sign of establishing a communication connection, where 0x102d41900 is the task object address of the current AirDrop.

[0072] In addition, if Figure 2 As shown, "No contact for node with id = 561c85920bfa"

[0073] The 561c85920bfa in the code is the AirDrop ID of the sending iPhone.

[0074] Once you have determined the AirDrop ID of the sending iPhone, you can then look up the name of the sending iPhone.

[0075] Figure 3 FIG. 1 shows a screenshot of the process of searching for the name of the iPhone phone at the sending end in one embodiment of the present invention. Figure 3 As shown, the process name keyword "AirDrop" is searched. After determining that the AirDrop ID of the sender iPhone is 561c85920bfa, it can be determined that the name of the sender iPhone corresponding to the current AirDrop ID 561c85920bfa is xlyiPhone.

[0076] Figure 3A The screenshots of the process of searching for the temporary storage path of files on the receiving end iPhone mobile phone in the embodiment of the present invention are shown. Figure 3A As shown, the temporary file storage path of the receiving iPhone can be obtained by searching for the keyword "com.apple.AirDrop" in the process.

[0077] As shown in the following message:

[0078] / var / mobile / Downloads / com.apple.AirDrop / 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719 / Files, where "69A3F245-B7A1-4D3C-BB64-CE99A4CFD719" is the task ID and " / Files" is the folder name. The relevant logs are as follows:

[0079] New incoming transfer <SFAirDropTransfer:identifier:69A3F245-B7A1-4D3C-BB64-CE99A4CFD719,transferState:Unknown,userResponse:None,needsAction:yes,possibleActions:NULL,metadata:<SFAirDropTransferMetaData:transferTypes:[Unclassified],verifiableIdentity:no,hasContactIdentifier:no,senderIsMe:no,canAutoAccept:no,sender:"xlyiPhone",hasPreviewImage:yes,hasSmallPreviewImage:no> >with items:{(

[0080] <SFAirDropTransferItem:type:public.png,count:1,isFile:yes> )},

[0081] AirDrop destination set to

[0082] / var / mobile / Downloads / com.apple.AirDrop / 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719 / / Files".

[0083] S302: Search the decompressed system log to determine whether an abnormal interruption occurs during the AirDrop process. If so, execute step S303; otherwise, execute step S304;

[0084] Specifically, find out whether the keyword "Cleaningup" is contained in the process after the current AirDrop is closed. If not, it means that an abnormal interruption occurred in the AirDrop process, and vice versa.

[0085] Figure 4 FIG. 1 shows a screenshot of a process related to closing AirDrop due to an abnormal interruption in an embodiment of the present invention. Figure 4 As shown, in the process after AirDrop is closed, no "Cleaning up" related process appears. Therefore, it is determined that the current AirDrop process is interrupted due to an abnormality.

[0086] S303: Search the decompressed system log, obtain the information about AirDrop being closed due to abnormal interruption in the log of the AirDrop communication connection, obtain the name of the sender's iPhone, AirDropID, and the storage path, number, name, and type of the sent files on the sender, so as to calibrate the closed-loop chain of evidence tracing during the abnormal interruption, and execute step S307;

[0087] Specifically, for a method of obtaining the name of the sending iPhone, the AirDrop ID, and the storage path of the sent files, the number of sent files, the names of the sent files, and the types of the sent files, please refer to the following step S400.

[0088] S304: Search the decompressed system log to determine whether the user chooses to accept the AirDrop process. If yes, execute step S305. Otherwise, it indicates that the user chooses to reject the AirDrop process, and execute step S306.

[0089] Figure 5 A screenshot showing the process of whether the user chooses to accept / reject the AirDrop process in an embodiment of the present invention. Figure 5 As shown in the following log, check whether the AirDrop message body contains the keyword "accept" or "reject".

[0090] Setting notification options:["SBUserNotificationButtonDefinitions":[[AnyHashable("_SBSButtonTitle"):Deny,

[0091] AnyHashable("_SBSButtonPresentationStyle"):0,

[0092] AnyHashable("_SBSButtonPreferred"):0],

[0093] [AnyHashable("_SBSButtonPresentationStyle"):0,

[0094] AnyHashable("_SBSButtonTitle"): Accept,

[0095] AnyHashable("_SBSButtonPreferred"):1]],

[0096] "SBUserNotificationAllowLockscreenDismissalKey":false,

[0097] "DismissOnLock":false,"SBUserNotificationIconImagePath":

[0098] " / System / Library / PrivateFrameworks / Sharing.framework / AirDrop-LockScreen.png","SBUserNotificationDontDismissOnUnlock":true,

[0099] "AlertTopMost":true].

[0100] S305: Search the decompressed system log, obtain the data transfer log and obtain the type title, storage link address, task object address, and task ID of the AirDrop data;

[0101] FIG. 6A to FIG. 6C 1 shows a screenshot of the relevant process of data transfer in an embodiment of the present invention. FIG. 6A to FIG. 6C As shown, the relevant logs are as follows:

[0102] User response:Accepted for transfer with id

[0103] 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719.

[0104] Delaying trigger of action <SFAirDropAction,transferIdentifier:

[0105] 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719,actionIdentifier:com.apple.mobileslideshow,title:"Photo",singleItemTitle:"Accept",requiredTransferState:Completed-ActionsStarted,requiresUnlockedUI:no,shouldUpdateUserResponse:yes>till transferState reaches requirement ClosedAirDrop connection 0x102d41900

[0106] PHPhotoLibrary performChanges reported success for 1 items.

[0107] Opening URLs:

[0108] ("photos: / / asset?albumname=camera-roll&identifier=26CD620B-EB11-494C-82E5-F61A31E70CC8 / L0 / 001")

[0109] The above title: "Photos" is the type title of the AirDrop data, Opening URLs is the link address where the file is stored, and 0x102d41900 is the current AirDrop task object address.

[0110] 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719 is the task ID.

[0111] S306: Search the decompressed system log, obtain the log of clearing the cache, confirm that the current AirDrop is completed and check the task ID. The corresponding path of the cleared cache is the same as the temporary storage path of the file on the receiving iPhone;

[0112] Figure 7 FIG. 1 shows a screenshot of a log of clearing cache in one embodiment of the present invention. Figure 7As shown, Removingtransfer with id 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719Cleaning up transferwith id 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719Cleaning up URL

[0113] / var / mobile / Downloads / com.apple.AirDrop / 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719

[0114] The above logs clearly show the relevant logs of clearing the cache. Note that the corresponding path of the cleared cache is the same as the temporary storage path of the files on the receiving iPhone, that is,

[0115] / var / mobile / Downloads / com.apple.AirDrop / 69A3F245-B7A1-4D3C-BB64-

[0116] CE99A4CFD719.

[0117] In step S306, determining that the current AirDrop is completed and checking the task ID includes the following steps:

[0118] The paired messages of the start of the task object address and the end of the task object address are used as marks to divide the current AirDrop message body, and the system log between the start of the task object address and the end of the task object address is used as the current AirDrop message body to obtain the evidence chain information.

[0119] In this embodiment, the task object address is 0x102d41900. Figure 2 As shown, “New AirDropconnection0x102d41900” is the beginning of the task object address and also the sign of establishing a communication connection.

[0120] Figure 8 A screenshot showing the process of ending the task object address (i.e., AirDrop closing) in an embodiment of the present invention;

[0121] like Figure 8As shown, "Closed AirDrop connection 0x102d41900" is the end of the task object address. As one of the methods to mark the current AirDrop message body, the system log between the beginning of the task object address (keyword "New AirDrop connection") and the end of the task object address (keyword "Closed AirDropconnection") can be used as the current AirDrop message body to obtain the evidence chain information.

[0122] In addition, as another method to determine the current AirDrop message body, the unique task ID corresponding to the current AirDrop is used to filter the current AirDrop message body. In this embodiment, the task ID is 69A3F245-B7A1-4D3C-BB64-CE99A4CFD719, which is the unique task ID corresponding to the entire task process of the current AirDrop. Therefore, we can filter a complete AirDrop message body by the task ID.

[0123] S307: Output the evidence chain information obtained in the AirDrop process, including the names of the iPhone phones of the sender and the receiver, AirDrop ID, process name, date / time, as well as the storage path of the sent files, the number of sent files, the names of the sent files, the types of the sent files, and the temporary storage path of the files of the receiver's iPhone;

[0124] S400: With respect to the obtained log of the receiving iPhone, the corresponding data in the system log of the sending iPhone is obtained to calibrate the closed-loop chain of evidence tracing, wherein the corresponding data includes the name of the receiving iPhone, the AirDrop ID, and the storage path of the sent files, the number of sent files, the name of the sent files, and the type of the sent files in the sending end.

[0125] Fig. 9A , Fig. 9B FIG. 1 shows a screenshot of the system log of an iPhone mobile phone at the sending end in one embodiment of the present invention. Fig. 9A , Fig. 9B As shown, in order to quickly obtain the corresponding data in the system log of the iPhone phone at the sending end, you can search for the keyword "Connected to

[0126] 561c85920bfa", where "561c85920bfa" is the AirdropID of the receiving iPhone. As shown in the figure, the logs involving date, time, IPv6 addresses of both the sender and the receiver, communication port, name of the receiving iPhone and Airdrop ID are as follows:

[0127] Connected to 561c85920bfa from[fe80::dc0a:edff:fe10:a048%awdl0.51268]=>[fe80::c8d6:95ff:febc:4ee5%awdl0.8770@awdl0]

[0128] No contact for node with id=561c85920bfa

[0129] No identifier found for node <SFNode

[0130] {xlyiPhone,id=561c85920bfa,dev=(null),t=Bonjour,sib=NULL}>

[0131] In addition, as shown in the following log, the name of the sent file is IMG_0003.jpg, the path on the sender is a temporary path, and it will be automatically cleared after sending / exiting; the name of the receiving iPhone is

[0132] xlyiPhone; the file type sent is public.jpeg; ReceiverID is the Airdrop ID of the receiving iPhone = 561c85920bfa; the receiving iPhone

[0133] SessionID = 651DED5370CE and the Airdrop ID of the receiving iPhone; the number of files sent is 1 (Starting to send 1files):

[0134]

[0135]

[0136] Therefore, with respect to the log of the receiving iPhone, the corresponding data in the system log of the sending iPhone is obtained. That is, by performing corresponding verification through the information in the logs of both the sender and the receiver, the closed-loop chain of evidence tracing can be calibrated.

[0137] The above method provided by the present invention solves the technical problem that there is no method for AirDrop traceability evidence chain in the prior art.

[0138] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for tracing the evidence chain of AirDrop, characterized in that: The following steps are involved: S100: Generate and summarize the system log of the receiving iPhone; S200: decompressing the system log; S300: Searching for the decompressed system log and obtaining evidence chain information includes the following steps: S301: Search the decompressed system log, obtain the AirDrop communication connection log and obtain the name of the sender's iPhone, the AirDrop ID, and obtain the task ID and temporary file storage path of the receiver's iPhone; S302: Search the decompressed system log to determine whether an abnormal interruption occurs during the AirDrop process. If so, execute step S303; otherwise, execute step S304; S303: Search the decompressed system log, obtain the information about AirDrop being closed due to abnormal interruption in the log of the AirDrop communication connection, obtain the name of the sender's iPhone, the AirDrop ID, and the storage path, number, name, and type of the sent files on the sender, so as to calibrate the closed-loop chain of evidence tracing during the abnormal interruption, and execute step S307; S304: Search the decompressed system log to determine whether the user chooses to accept the AirDrop process. If yes, execute step S305. Otherwise, it indicates that the user chooses to reject the AirDrop process, and execute step S306. S305: Search the decompressed system log, obtain the data transfer log and obtain the type title, storage link address, task object address, and task ID of the AirDrop data; S306: Search the decompressed system log, obtain the log of clearing the cache, confirm that the current AirDrop is completed and check the task ID. The corresponding path of the cleared cache is the same as the temporary storage path of the file on the receiving iPhone; S307: Output the evidence chain information obtained in the AirDrop process, including the names of the iPhone phones of the sender and the receiver, AirDrop ID, process name, date / time, as well as the storage path of the sent files, the number of sent files, the names of the sent files, the types of the sent files, and the temporary storage path of the files of the receiver's iPhone; S400: Obtain the log of the iPhone at the sending end according to the log of the iPhone at the receiving end The corresponding data in the mobile phone system log is used to calibrate the closed-loop chain of evidence tracing, where the corresponding data includes the name of the receiving iPhone, the AirDrop ID, and the storage path of the sent files, the number of sent files, the name of the sent files, and the type of the sent files.

2. A method for AirDrop traceability evidence chain according to claim 1, characterized in that: Step S100 includes the following steps: S101: Both the receiving and sending iPhones are installed with the profile certificate officially provided by Apple; S102: After the profile certificate is installed, restart the phone; S103: trigger and generate system log; S104: Waiting for a first period of time to complete the generation of the iPhone mobile phone system log; S105: Upload the generated system log to the computer.

3. A method for AirDrop traceability evidence chain according to claim 2, characterized in that: Step S103 includes the following steps: Press and hold the volume up and down buttons and the side / top button for more than 1 second. After the phone vibrates, release the button and the iPhone will trigger and generate a system log.

4. According to claim 2, a method for AirDrop traceability evidence chain is characterized in that: The first duration is no less than 10 minutes.

5. According to claim 1, a method for AirDrop traceability evidence chain is characterized in that: In step S306, determining that the current AirDrop is completed and checking the task ID includes the following steps: The paired messages of the start of the task object address and the end of the task object address are used as marks to divide the current AirDrop message body, and the system log between the start of the task object address and the end of the task object address is used as the current AirDrop message body to obtain the evidence chain information.

6. A method for AirDrop traceability evidence chain according to claim 5, characterized in that: As an optional method for determining the current AirDrop message body, a unique task ID corresponding to the current AirDrop is used to filter the current AirDrop message body.

Images