Electronic forensic analysis method based on image recognition technology

Abstract

The invention discloses an electronic forensic analysis method based on an image recognition technology, and relates to the technical field of image processing, and the method comprises the following steps: S1, determining an analysis target and a demand; s2, collecting data; s3, data security and isolation; s4, preprocessing the data; s5, performing preliminary analysis by using an image recognition technology; s6, extracting metadata; s7, carrying out image segmentation and object identification; s8, verifying a result; and S9, generating an evidence obtaining report. According to the electronic forensic analysis method based on the image recognition technology, the efficiency and accuracy of electronic forensic can be remarkably improved, and the image content can be automatically recognized and analyzed by utilizing advanced machine learning and deep learning models, so that key information is quickly screened out, manual intervention is reduced, errors are reduced, and the efficiency of electronic forensic analysis is improved. By enhancing the secure storage and isolation measures of the data, the data security and integrity in the evidence obtaining process are ensured, and a more detailed and reliable evidence obtaining report is provided for legal experts and decision makers.

Description

Technical Field

[0001] The present invention relates to the technical field of image processing, and in particular to an electronic forensic analysis method based on image recognition technology. Background Art

[0002] In the digital age, with the popularity of electronic devices and the explosive growth of image data, the application of image recognition technology in the field of electronic forensics has become increasingly important. Traditional electronic forensics methods mainly rely on manual analysis and simple digital tools, which often seem to be inadequate when dealing with large-scale data. Especially when it is necessary to deal with complex image content and a large amount of metadata, traditional methods often cannot quickly and effectively locate and analyze key information.

[0003] Existing electronic forensics technologies face the following shortcomings when processing high-resolution and large-volume image files:

[0004] Slow processing speed: Traditional methods rely on manual operations and take a long time to process a large number of image files.

[0005] Limited accuracy: Manual analysis is easily limited by the operator's skills and experience, and the error rate is relatively high.

[0006] Security issues: Failure to fully utilize modern encryption and security technologies during data transmission and storage can easily lead to data leakage or tampering.

[0007] Difficulty in handling complex scenes: Existing technologies have difficulty in coping with image analysis requirements with complex backgrounds or numerous objects, especially when object recognition and image segmentation are required. Summary of the invention

[0008] In view of the deficiencies of the prior art, the present invention provides an electronic forensic analysis method based on image recognition technology to solve the problems raised in the above background technology.

[0009] To achieve the above object, the present invention provides the following technical solution: an electronic forensics analysis method based on image recognition technology, comprising the following steps:

[0010] S1. Determine analysis objectives and requirements

[0011] Identify the specific goals and requirements of the analysis, including the format type of the image file, the specific purpose of the image file, and the displayed content of the image file;

[0012] S2. Collect data

[0013] Collecting image files from electronic devices storing image files, and using forensic tools to copy the image data without changing the original data of the image files;

[0014] S3, Data Security and Isolation

[0015] Securely store and isolate the collected image data, store the data on a secure server, use encryption technology to protect data security, and only authorized forensic personnel can access the data;

[0016] S4. Preprocessing Data

[0017] Preprocess the image data, including format conversion, resolution adjustment, and color management, to standardize the image data so that the subsequent steps can process the data effectively;

[0018] S5. Use image recognition technology for preliminary analysis

[0019] Use image recognition algorithms to conduct preliminary analysis on preprocessed images, quickly filter out key information from a large amount of image data, and provide clues for in-depth analysis;

[0020] S6. Metadata extraction

[0021] Extract metadata from image files. Metadata includes information such as shooting date, time, location, and camera settings, providing key evidence for the origin and authenticity of the image.

[0022] S7. Image segmentation and object recognition

[0023] Use image segmentation models to separate different objects in an image, and use object detection models to identify and locate specific objects in an image to obtain the results of image recognition;

[0024] S8. Result verification

[0025] Verify and proofread the results obtained through image recognition, including comparing them with existing databases or known information to confirm the accuracy of the recognition results;

[0026] S9. Generate forensic report

[0027] Based on the verification results, a forensic report is generated, which includes the methodology, analysis process, identification results and interpretation of the results.

[0028] To further optimize the technical solution, in step S1:

[0029] The image file formats include JPEG, PNG, SVG, GIF, and PDF.

[0030] Determine the specific purpose of the image file, such as whether it is used to recover deleted files or repair files that are missing some data;

[0031] Analyze the displayed content of the image file to identify specific metadata or specific objects in the image content.

[0032] To further optimize the technical solution, in step S2, the specific steps of collecting data are as follows:

[0033] Choose appropriate hardware or software write protection tools and data copy tools based on needs and device types;

[0034] Ensure the operating environment is secure and use a forensic operating system to avoid writing system logs and temporary files;

[0035] Copy the data using the chosen tool according to standard operating procedures, ensuring that all operations comply with forensic principles, such as not changing timestamps and other metadata;

[0036] After the copy is complete, verify the integrity of the data by comparing the hash values ​​to ensure that the copied data is exactly the same as the original data.

[0037] Further optimizing the technical solution, in step S3, a mathematical model is constructed to optimize the encryption and isolation process of data storage to ensure the security and isolation of data, and encryption technology and access control strategies are used to ensure data security in consideration of different data characteristics and security requirements;

[0038] Assume a set of image data (D), where each data item (d i ) need to be stored securely, and a security function (S(d, k, t)) is defined to represent the security status of the data item (d) under the encryption key (k) and isolation time (t);

[0039] The mathematical model is expressed as:

[0040] S(d,k,t))=e -λt .f(k,d)

[0041] in:

[0042] (e -λt ) represents the impact of isolation time on data security, where (λ) is the decay coefficient, indicating the negative impact of time on data security;

[0043] (f(k, d)) is a function of the key (k) and the data (d), which is used to measure the effectiveness of the key on the data encryption;

[0044] Assume that (f(k, d)) is a value between 0 and 1, where a value closer to 1 indicates stronger encryption strength.

[0045] To further optimize the technical solution, in step S5, the image recognition algorithm identifies objects, scenes and activities in the image based on a machine learning or deep learning model, such as using a convolutional neural network (CNN) to identify specific features or objects in the image and classify various objects and scenes in the image. Through adaptive adjustment, the network optimizes its processing strategy for each type of image.

[0046] To further optimize this technical solution, after optimizing the processing strategy for each type of image, we also use transfer learning technology to use the model pre-trained on a large data set as the initial weight to further accelerate the training and analysis process of a specific image data set.

[0047] Further optimizing the technical solution, in step S6, assuming that the metadata set (M) includes information about the shooting date (D), time (T), location (L), and camera settings (S), a probability model (P) is constructed to evaluate whether a given image belongs to a specific source (S i ), the probability model is as follows:

[0048]

[0049] in,

[0050] (w1, w2, w3, w4) are weight parameters, representing the importance of each metadata factor;

[0051] (f1, f2, f3, f4) are feature functions used to extract features from date, time, location, and camera settings;

[0052] (X) is a normalization factor that ensures that the probabilities sum to 1.

[0053] To further optimize the technical solution, in step S7, the image segmentation model is as follows:

[0054] S=f seg (I; θ seg )

[0055] in,

[0056] (S) represents the output segmented image, where each pixel is labeled as belonging to a specific category (such as foreground or background);

[0057] (f seg ) represents the function of the segmentation model;

[0058] (I) is the input image;

[0059] (θ seg ) are model parameters, which are adjusted during training using optimization algorithms such as gradient descent.

[0060] Further optimizing the technical solution, in step S7, the object detection model includes a region proposal network (RPN) and a classification / regression network;

[0061] The region proposal network (RPN) is used to generate possible object region proposals, expressed as:

[0062] P = f RPN (I; θ RPN )

[0063] in:

[0064] (P) is a set of region proposals, each of which contains a bounding box of a candidate object;

[0065] (f RPN}) is the function of RPN;

[0066] (θ RPN ) is the parameter of RPN;

[0067] The classification / regression network is used for classification and bounding box fine-tuning, denoted as;

[0068] (C,B)=f cls / reg (P, I; θ cls / reg )

[0069] in:

[0070] (c) is the classification result of each proposal, such as object category or background;

[0071] (B) is the bounding box coordinates after fine-tuning;

[0072] (f cls / reg ) is the function of the classification / regression network;

[0073] (θ cls / reg ) are the parameters of the network.

[0074] To further optimize the technical solution, in step S8, based on the similarity scoring model, the similarity score between the result obtained by image recognition and the corresponding object in the existing database is calculated. The similarity scoring model is as follows:

[0075]

[0076] in,

[0077] (S) indicates similarity score, ranging from 0 to 1;

[0078] (x1, x2, ..., x n ) is the feature vector extracted from the image;

[0079] (β0,β1,...,β n ) are model parameters, which are learned through the training data set.

[0080] Compared with the prior art, the present invention provides an electronic forensic analysis method based on image recognition technology, which has the following beneficial effects:

[0081] This electronic forensics analysis method based on image recognition technology can significantly improve the efficiency and accuracy of electronic forensics. It uses advanced machine learning and deep learning models to automatically identify and analyze image content, thereby quickly screening out key information, reducing human intervention, and reducing errors. By strengthening data security storage and isolation measures, it ensures data security and integrity during the forensics process, providing legal experts and decision makers with more detailed and reliable forensics reports. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 A schematic diagram of the process of an electronic forensic analysis method based on image recognition technology proposed by the present invention;

[0083] Figure 2 A confidence correction model that can be used in an electronic forensics analysis method based on image recognition technology proposed by the present invention;

[0084] Figure 3 Another image segmentation model that can be adopted by the electronic forensic analysis method based on image recognition technology proposed by the present invention. DETAILED DESCRIPTION

[0085] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0086] Example:

[0087] See also Figure 1 , an electronic forensic analysis method based on image recognition technology, comprising the following steps:

[0088] S1. Determine analysis objectives and requirements

[0089] Clarify the specific goals and requirements of the analysis, including the format type of the image file, the specific purpose of the image file, and the displayed content of the image file.

[0090] The image file formats include JPEG, PNG, SVG, GIF, and PDF.

[0091] Determine the specific purpose of the image file, such as whether it is used to recover deleted files or repair files that are missing some data;

[0092] Analyze the displayed content of the image file to identify specific metadata or specific objects in the image content.

[0093] S2. Collect data

[0094] Collect image files from electronic devices that store image files, and use forensic tools to copy the image data without changing the original data of the image files.

[0095] The specific steps for collecting data are as follows:

[0096] Choose appropriate hardware or software write protection tools and data copy tools based on needs and device types;

[0097] Ensure the operating environment is secure and use a forensic operating system to avoid writing system logs and temporary files;

[0098] Copy the data using the chosen tool according to standard operating procedures, ensuring that all operations comply with forensic principles, such as not changing timestamps and other metadata;

[0099] After the copy is complete, verify the integrity of the data by comparing the hash values ​​to ensure that the copied data is exactly the same as the original data.

[0100] S3, Data Security and Isolation

[0101] The collected image data is securely stored and isolated, stored on a secure server, and protected using encryption technology. Only authorized forensic personnel can access the data.

[0102] Build mathematical models to optimize the encryption and isolation process of data storage to ensure data security and isolation, consider different data characteristics and security requirements, and use encryption technology and access control strategies to ensure data security;

[0103] Assume a set of image data (D), where each data item (d i ) need to be stored securely, and a security function (S(d, k, t)) is defined to represent the security status of the data item (d) under the encryption key (k) and isolation time (t);

[0104] The mathematical model is expressed as:

[0105] S(d,k,t)=e -λt f(k,d)

[0106] in:

[0107] (e -λt ) represents the impact of isolation time on data security, where (λ) is the decay coefficient, indicating the negative impact of time on data security;

[0108] (f(k, d)) is a function of the key (k) and the data (d), which is used to measure the effectiveness of the key on the data encryption;

[0109] Assume that (f(k, d)) is a value between 0 and 1, where a value closer to 1 indicates stronger encryption strength.

[0110] In actual forensic analysis, we will select the appropriate key and expected storage time for each data item to calculate the value of (S(d, k, t)) to ensure that the security of each data item meets a preset security standard. By adjusting (λ), (k), and (t), we can optimize the encryption and isolation strategy.

[0111] For example, if the (S(d, k, t)) value of a data item is lower than the security standard, we may need to choose a stronger key or shorten the isolation time of the data to improve the security of the data.

[0112] The model provides a dynamic way to evaluate data security by combining the impact of time and the effectiveness of encryption keys. In addition, by adjusting the decay coefficient (λ), security requirements can be customized according to different business scenarios and data sensitivity, making the model not only suitable for electronic forensics, but also adaptable to other environments that require high data protection.

[0113] S4. Preprocessing Data

[0114] Preprocess the image data, including format conversion, resolution adjustment, and color management, to standardize the image data so that the subsequent steps can process the data effectively.

[0115] In this embodiment,

[0116] Format conversion: Convert all image files to one or a few easy-to-process formats, such as JPEG or PNG. This not only simplifies the processing process, but also reduces compatibility issues caused by format differences. For image files in non-standard or rare formats, it may be necessary to use specialized decoders or converters to ensure data integrity.

[0117] Resolution Adjustment: Adjust the resolution of the image based on the analysis requirements. Too high a resolution will increase processing time, while too low a resolution may lose key details. By standardizing the resolution, you can improve processing efficiency while maintaining the analysis effect. For images that require precise measurement or proportional analysis, it is particularly important to ensure the accuracy and consistency of the resolution.

[0118] Color management: Convert images to a unified color space, such as sRGB or Adobe RGB, to eliminate problems caused by differences in color display between different devices or software. Perform color correction to adjust parameters such as brightness, contrast, and saturation of the image to ensure visual consistency and accuracy. This helps the algorithm recognize features in the image more accurately.

[0119] Noise Removal: Apply filtering techniques (such as Gaussian filtering, median filtering, etc.) to remove noise and interfering elements in the image. Noise may be caused by environmental factors during shooting, data loss during transmission, or equipment failure. Noise removal helps improve image quality and makes it easier for image recognition algorithms to capture useful information.

[0120] Image enhancement: Use image enhancement techniques (such as sharpening, edge detection, etc.) to improve the visual effect of the image and highlight the key features in the image. This helps the algorithm to more accurately identify objects or scenes in the image. Adjust the image's contrast, clarity and other parameters as needed to better meet the needs of subsequent analysis.

[0121] Data cleaning: Check and delete duplicate or irrelevant image files to reduce the amount of data processed and improve analysis efficiency. Identify and process damaged image files, and try to repair or replace them to avoid affecting the analysis results.

[0122] Standardized naming and classification: Assign uniform naming rules to image files for easier management and retrieval. Categorize images based on image content or source to quickly locate relevant images in subsequent analysis.

[0123] S5. Use image recognition technology for preliminary analysis

[0124] Use image recognition algorithms to conduct preliminary analysis on preprocessed images, quickly filter out key information from large amounts of image data, and provide clues for in-depth analysis.

[0125] Image recognition algorithms are based on machine learning or deep learning models to identify objects, scenes, and activities in images. For example, convolutional neural networks (CNNs) are used to identify specific features or objects in images and classify various objects and scenes in images. Through adaptive adjustment, the network optimizes its processing strategy for each type of image. It also uses transfer learning technology to use models pre-trained on large data sets as initial weights to further accelerate the training and analysis process of specific image data sets.

[0126] S6. Metadata extraction

[0127] Extract metadata from image files. Metadata includes information about shooting date, time, location, and camera settings, providing critical evidence for the origin and authenticity of the image.

[0128] Given a metadata set (M), which includes information about the shooting date (D), time (T), location (L), and camera settings (S), a probabilistic model (P) is constructed to assess whether a given image belongs to a particular source (S i ), the probability model is as follows:

[0129]

[0130] in,

[0131] (w1, w2, w3, w4) are weight parameters, representing the importance of each metadata factor;

[0132] (f1, f2, f3, f4) are feature functions used to extract features from date, time, location, and camera settings;

[0133] (Z) is a normalization factor that ensures that the sum of the probabilities is 1.

[0134] In this embodiment, the characteristic function example is:

[0135] (f1(D)): Converts a date to the number of days since the beginning of the year.

[0136] (f2(T)): Converts time to minutes of day.

[0137] (f3(L)): Encode the location as a numerical value of a geotag.

[0138] (f4(S)): Score based on the complexity of the camera setup.

[0139] This model can be used to verify authenticity during the forensics process:

[0140] The authenticity of an image is assessed by comparing the match between the image metadata and the known data source. i |M)) is above a certain threshold, then it can be considered that the image is likely to come from that source.

[0141] S7. Image segmentation and object recognition

[0142] Use the image segmentation model to separate different objects in the image, and use the object detection model to identify and locate specific objects in the image to obtain the results of image recognition.

[0143] The image segmentation model is as follows:

[0144] S=fseg (I; θ seg )in,

[0145] (S) represents the output segmented image, where each pixel is labeled as belonging to a specific category (such as foreground or background);

[0146] (f seg ) represents the function of the segmentation model;

[0147] (I) is the input image;

[0148] (θ seg ) are model parameters, which are adjusted during training using optimization algorithms such as gradient descent.

[0149] The object detection model includes a region proposal network (RPN) and a classification / regression network;

[0150] The region proposal network (RPN) is used to generate possible object region proposals, expressed as:

[0151] P = f RPN (I; θ RPN )

[0152] in:

[0153] (P) is a set of region proposals, each of which contains a bounding box of a candidate object;

[0154] (f RPN}) is the function of RPN;

[0155] (θ RPN ) is the parameter of RPN;

[0156] The classification / regression network is used for classification and bounding box fine-tuning, expressed as:

[0157] (C,B)=f cls / reg (P, I; θ cls / reg )

[0158] in:

[0159] (C) is the classification result of each proposal, such as object category or background;

[0160] (B) is the bounding box coordinates after fine-tuning;

[0161] (f cls / reg ) is the function of the classification / regression network;

[0162] (θ cls / reg ) are the parameters of the network.

[0163] In the training phase, we use annotated image datasets (containing object categories and bounding box information) to train RPN and classification / regression networks. The goal is to let RPN generate accurate region proposals and let the classification / regression network correctly classify these proposals and fine-tune the bounding boxes.

[0164] In the inference phase, we input the unlabeled image (I) into the model. First, the RPN generates a series of region proposals (P). Then, the classification / regression network classifies and adjusts the bounding boxes of these proposals to obtain the final detection results (C, B). This result can help us identify and locate specific objects in the image.

[0165] In this embodiment, it is also possible to use Figure 3 The image segmentation model shown.

[0166] exist Figure 3 middle,

[0167] (S k ) is the (k)th segment of image (I).

[0168] (G k ) is the partitioning function for the (k)th segment.

[0169] (θ) represents the network parameters.

[0170] (v jk ) is the weight of the (k)th segment on the (j)th feature.

[0171] (g j (I;θ)) is the (j)th feature extracted from image (I).

[0172] (c k ) is the bias term for segment (k).

[0173] The (Softmax) function is an activation function commonly used in multi-class classification problems. It converts the output into a probability distribution, where each output represents the probability that the input belongs to a certain category.

[0174] S8. Result verification

[0175] The results obtained through image recognition are verified and proofread, including comparison with existing databases or known information to confirm the accuracy of the recognition results.

[0176] Based on the similarity scoring model, the similarity score between the image recognition result and the corresponding object in the existing database is calculated. The similarity scoring model is as follows:

[0177]

[0178] in,

[0179] (S) indicates similarity score, ranging from 0 to 1;

[0180] (x1, x2, ..., x n ) is the feature vector extracted from the image;

[0181] (β0,β1,...,β n ) are model parameters, which are learned through the training data set.

[0182] This model is suitable for evaluating the similarity between objects recognized by image recognition algorithms and known objects in the database. A high similarity score indicates that the recognition result matches the known data well, increasing the credibility of the recognition result. This method is particularly suitable for recognizing specific signs or faces.

[0183] In this embodiment, in complex situations where the automatic recognition algorithm may make mistakes, the use of a confidence correction model can help evaluate the reliability of the recognition result. Figure 2 shown.

[0184] exist Figure 2 In the figure, (C) represents the corrected confidence, (p) is the confidence output by the original recognition model, and (α) and (γ) are adjustment parameters that can be determined by the validation dataset.

[0185] The confidence correction model provides a more robust confidence assessment by adjusting the original confidence to cope with possible errors of the automatic recognition algorithm in specific situations. By adjusting the values ​​of (α) and (γ) in different scenarios, the application effect of the model can be optimized to make it more suitable for specific analysis tasks.

[0186] The combination of these two models can provide a comprehensive method to verify and proofread the accuracy of image recognition results in electronic forensics, enhancing the credibility and application value of the results.

[0187] S9. Generate forensic report

[0188] Based on the verification results, a forensic report is generated, which includes the methodology, analysis process, identification results and interpretation of the results.

[0189] The beneficial effects of the present invention are:

[0190] This electronic forensics analysis method based on image recognition technology can significantly improve the efficiency and accuracy of electronic forensics. It uses advanced machine learning and deep learning models to automatically identify and analyze image content, thereby quickly screening out key information, reducing human intervention, and reducing errors. By strengthening data security storage and isolation measures, it ensures data security and integrity during the forensics process, providing legal experts and decision makers with more detailed and reliable forensics reports.

[0191] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0192] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An electronic forensic analysis method based on image recognition technology, characterized in that: The following steps are involved: S1. Determine analysis objectives and requirements Identify the specific goals and requirements of the analysis, including the format type of the image file, the specific purpose of the image file, and the displayed content of the image file; S2. Collect data Collecting image files from electronic devices storing image files, and using forensic tools to copy the image data without changing the original data of the image files; S3, Data Security and Isolation Securely store and isolate the collected image data, store the data on a secure server, use encryption technology to protect data security, and only authorized forensic personnel can access the data; S4. Preprocessing Data Preprocess the image data, including format conversion, resolution adjustment, and color management, to standardize the image data so that the subsequent steps can process the data effectively; S5. Use image recognition technology for preliminary analysis Use image recognition algorithms to conduct preliminary analysis on preprocessed images, quickly filter out key information from a large amount of image data, and provide clues for in-depth analysis; S6. Metadata extraction Extract metadata from image files. Metadata includes information such as shooting date, time, location, and camera settings, providing key evidence for the origin and authenticity of the image. S7. Image segmentation and object recognition Use image segmentation models to separate different objects in an image, and use object detection models to identify and locate specific objects in an image to obtain the results of image recognition; S8. Result verification Verify and proofread the results obtained through image recognition, including comparing them with existing databases or known information to confirm the accuracy of the recognition results; S9. Generate forensic report Based on the verification results, a forensic report is generated, which includes the methodology, analysis process, identification results and interpretation of the results.

2. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S1: The image file formats include JPEG, PNG, SVG, GIF, and PDF. Determine the specific purpose of the image file, such as whether it is used to recover deleted files or repair files that are missing some data; Analyze the displayed content of the image file to identify specific metadata or specific objects in the image content.

3. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S2, the specific steps of collecting data are as follows: Choose appropriate hardware or software write protection tools and data copy tools based on needs and device types; Ensure the operating environment is secure and use a forensic operating system to avoid writing system logs and temporary files; Copy the data using the chosen tool according to standard operating procedures, ensuring that all operations comply with forensic principles, such as not changing timestamps and other metadata; After the copy is complete, verify the integrity of the data by comparing the hash values ​​to ensure that the copied data is exactly the same as the original data.

4. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S3, a mathematical model is constructed to optimize the encryption and isolation process of data storage to ensure the security and isolation of data, and encryption technology and access control strategies are used to ensure data security in consideration of different data characteristics and security requirements; Assume a set of image data (D), where each data item (d i ) need to be stored securely, and a security function (S(d, k, t)) is defined to represent the security status of the data item (d) under the encryption key (k) and isolation time (t); The mathematical model is expressed as: S(d,k,t)=e -λt ·f(k,d) in: (e -λt ) represents the impact of isolation time on data security, where (λ) is the decay coefficient, indicating the negative impact of time on data security; (f(k, d)) is a function of the key (k) and the data (d), which is used to measure the effectiveness of the key on the data encryption; Assume that (f(k, d)) is a value between 0 and 1, where a value closer to 1 indicates stronger encryption strength.

5. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S5, the image recognition algorithm identifies objects, scenes and activities in the image based on a machine learning or deep learning model, such as using a convolutional neural network (CNN) to identify specific features or objects in the image and classify various objects and scenes in the image. Through adaptive adjustment, the network optimizes its processing strategy for each type of image.

6. The electronic forensic analysis method based on image recognition technology according to claim 5 is characterized in that: After optimizing the processing strategy for each type of image, transfer learning technology is used to use the model pre-trained on a large data set as the initial weight to further accelerate the training and analysis process of specific image data sets.

7. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S6, assuming a metadata set (M), including information about shooting date (D), time (T), location (L), and camera settings (S), a probability model (P) is constructed to evaluate whether a given image belongs to a specific source (S i ), the probability model is as follows: in, (w1, w2, w3, w4) are weight parameters, representing the importance of each metadata factor; (f1, f2, f3, f4) are feature functions used to extract features from date, time, location, and camera settings; (Z) is a normalization factor that ensures that the sum of the probabilities is 1.

8. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S7, the image segmentation model is as follows: S=f seg (I;θ seg ) in, (S) represents the output segmented image, where each pixel is labeled as belonging to a specific category (such as foreground or background); (f seg ) represents the function of the segmentation model; (I) is the input image; (θ seg ) are model parameters, which are adjusted during training using optimization algorithms such as gradient descent.

9. The electronic forensic analysis method based on image recognition technology according to claim 1 is characterized in that: In step S7, the object detection model includes a region proposal network (RPN) and a classification / regression network; The region proposal network (RPN) is used to generate possible object region proposals, expressed as: P=f RPN (I;θ RPN ) in: (P) is a set of region proposals, each of which contains a bounding box of a candidate object; (f RPN }) is the function of RPN; (θ RPN ) is the parameter of RPN; The classification / regression network is used for classification and bounding box fine-tuning, expressed as: (C,B)=f cls / reg (P,I;θ cls / reg ) in: (C) is the classification result of each proposal, such as object category or background; (B) is the bounding box coordinates after fine-tuning; (f cls / reg ) is the function of the classification / regression network; (θ cls / reg ) are the parameters of the network.

10. The electronic forensic analysis method based on image recognition technology according to claim 1, characterized in that: In step S8, based on the similarity scoring model, the similarity score between the result obtained by image recognition and the corresponding object in the existing database is calculated. The similarity scoring model is as follows: in, (S) indicates similarity score, ranging from 0 to 1; (x1, x2 , ..., x n ) is the feature vector extracted from the image; (β0,β1,...,β n ) are model parameters, which are learned through the training data set.

Images