Digital forensics method and device, electronic equipment and storage medium

Abstract

The invention discloses a digital forensics method and device, electronic equipment and a storage medium, and the method comprises the steps: determining target equipment, and obtaining a forensics object of the target equipment; reading data from the evidence obtaining object by utilizing a bulkexactor tool, and storing the read data into a buffer area; extracting feature information from the data stored in the buffer area, and storing the feature information into a feature file; and processing the feature file into a histogram file, and analyzing the feature file and the histogram file to obtain a digital evidence obtaining result. The digital forensics effect is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a digital forensics method, device, electronic device and storage medium. Background Art

[0002] In traffic and terminal threat detection, cyber attackers often use various methods to hide their intrusion behaviors, making it difficult to recover from disasters and locate attackers. Digital Forensics is a branch of forensic science that covers the investigation of all devices that can store digital data. It is the recovery, investigation, inspection and analysis of materials found in the investigation, usually related to mobile devices and computer crimes. The forensic results obtained through digital forensics technology can help network security teams speed up the detection and resolution of network threats and prevent future network attacks.

[0003] In related technologies, only memory data or network data packets are analyzed to obtain information about running processes and network communication content. However, memory data is short-lived and volatile, and cannot reflect the entire state of a system. Network data packets are often encrypted and hidden, and communication content is invisible. There is a large amount of compressed data in the unallocated area of ​​the file system, and most of the commonly used forensic tools today omit this data, resulting in poor digital forensics results in related technologies.

[0004] Therefore, how to improve the effect of digital forensics is a technical problem that technicians in this field need to solve. Summary of the invention

[0005] The purpose of the present application is to provide a digital forensics method, device, electronic device and computer-readable storage medium, which improve the digital forensics effect.

[0006] To achieve the above objectives, the present application provides a digital forensics method, comprising:

[0007] Determine a target device and obtain a forensic object of the target device;

[0008] Using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer;

[0009] Extracting feature information from the data stored in the buffer, and storing the feature information in a feature file;

[0010] The feature file is processed into a histogram file, and the feature file and the histogram file are analyzed to obtain a digital forensics result.

[0011] The evidence collection object includes any combination of memory images, virtual memory files, virtual disk files, and images;

[0012] The method of using the bulk_extractor tool to read data from the forensic object includes:

[0013] Use the bulk_extractor tool to allocate multiple threads to read data from multiple different forensic objects.

[0014] The step of reading data from the forensic object using the bulk_extractor tool includes:

[0015] The bulk_extractor tool is used to read data from the compressed files and / or encrypted files in the forensic object.

[0016] Wherein, the buffer is a buffer of SBUFS structure;

[0017] Extracting feature information from the data stored in the buffer and storing the feature information in a feature file includes:

[0018] The data in each SBUF is scanned by a scanner, and the extracted feature information is stored in a feature file.

[0019] The step of extracting feature information from the data stored in the buffer includes:

[0020] Extracting executable file information and json information downloaded by malware from the data stored in the buffer;

[0021] Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes:

[0022] The feature file and the histogram file are analyzed to obtain malware investigation results.

[0023] The step of extracting feature information from the data stored in the buffer includes:

[0024] extracting encryption keys, hash values ​​and Ethernet related information from the data stored in the buffer;

[0025] Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes:

[0026] The characteristic file and the histogram file are analyzed to obtain network survey results.

[0027] The step of extracting feature information from the data stored in the buffer includes:

[0028] extracting identity information from the data stored in the buffer;

[0029] Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes:

[0030] The feature file and the histogram file are analyzed to obtain identity investigation results.

[0031] To achieve the above objectives, the present application provides a digital evidence collection device, comprising:

[0032] An acquisition module, used to determine a target device and acquire a forensic object of the target device;

[0033] A reading module, used to read data from the forensic object using a bulk_extractor tool, and store the read data in a buffer;

[0034] An extraction module, used for extracting feature information from the data stored in the buffer, and storing the feature information in a feature file;

[0035] The analysis module is used to process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a digital forensics result.

[0036] To achieve the above objectives, the present application provides an electronic device, including:

[0037] Memory for storing computer programs;

[0038] A processor is used to implement the steps of the above-mentioned digital forensics method when executing the computer program.

[0039] To achieve the above objectives, the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the digital forensics method described above are implemented.

[0040] From the above scheme, it can be seen that a digital forensics method provided by the present application includes: determining a target device and obtaining a forensics object of the target device; using a bulk_extractor tool to read data from the forensics object and storing the read data in a buffer; extracting feature information from the data stored in the buffer and storing the feature information in a feature file; processing the feature file into a histogram file, and analyzing the feature file and the histogram file to obtain a digital forensics result.

[0041] The digital evidence collection method provided by the present application uses the bulk_extractor tool for digital evidence collection. The bulk_extractor tool can automatically detect, decompress and recursively reprocess compressed data compressed using various algorithms, and is faster and more thorough. At the same time, the scanned objects are not limited to the memory images used in the relevant technology. The bulk_extractor tool can process any digital media, which improves the digital evidence collection effect. The present application also discloses a digital evidence collection device, an electronic device and a computer-readable storage medium, which can also achieve the above technical effects.

[0042] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific implementation methods, they are used to explain the present disclosure, but do not constitute a limitation to the present disclosure. In the drawings:

[0044] Figure 1 is a flow chart of a first digital forensics method according to an exemplary embodiment;

[0045] Figure 2 is a flow chart of a second digital forensics method according to an exemplary embodiment;

[0046] Figure 3 is a flow chart of a third digital forensics method according to an exemplary embodiment;

[0047] Figure 4 is a flow chart of a fourth digital forensics method according to an exemplary embodiment;

[0048] Figure 5 is a structural diagram of a digital evidence collection device according to an exemplary embodiment;

[0049] Figure 6 The figure is a structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In addition, in the embodiments of the present application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0051] The embodiment of the present application discloses a digital evidence collection method, which improves the digital evidence collection effect.

[0052] See also Figure 1 , according to a flowchart of a first digital forensics method shown in an exemplary embodiment, as shown in Figure 1 As shown, including:

[0053] S101: Determine a target device and obtain a forensic object of the target device;

[0054] In a specific implementation, the target device for digital forensics is determined, which may include a computer, a mobile phone, or other electronic devices. After the target device is determined, the forensic object on the target device that may contain valuable information is obtained. The forensic object can be any digital media, which may include memory images, virtual memory files, virtual disk files, images, hard drives, SSDs (Solid State Drives), optical media, camera cards, mobile phones, network data packet dumps, and other types of digital information. Conventional memory dump tools such as Dumplt are used to save the forensic object so that data can be read from it in subsequent steps.

[0055] S102: using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer;

[0056] In the specific implementation, a C++17 environment is built and a tool called bulk_extractor (bulk data extractor) is written, which can be deployed and compiled in Amazon Linux, Fedora Linux, Ubuntu or MacOS server systems or virtualization platforms. After obtaining the forensic objects of the target device, the bulk_extractor tool is used to read the data of these forensic objects. Bulk_extractor is a powerful forensic tool that can quickly extract large amounts of data from various storage media. After the data is read out, it will be temporarily stored in a buffer for further processing. As an intermediate storage area, the buffer ensures the integrity and availability of the data during the extraction process.

[0057] As a feasible implementation, the method of reading data from the forensic object using the bulk_extractor tool includes: using the bulk_extractor tool to allocate multiple threads to read data from multiple different forensic objects respectively. In a specific implementation, multiple threads are enabled, and each thread is allocated to read data from multiple different forensic objects.

[0058] As a feasible implementation manner, the using of bulk_extractor tool to read data from the forensic object includes: using bulk_extractor tool to read data from compressed files and / or encrypted files in the forensic object.

[0059] The bulk_extractor tool is a powerful digital forensic investigation tool that is able to extract useful information from disk images, files, or directories without parsing the file system or file system structure. This tool is particularly good at handling compressed data, such as ZIP (Zipped file), PDF (Portable Document Format), and GZIP (GNU Compressor) files, as well as incomplete or partially damaged data. Its ability to extract JPEG (Joint Photographic Experts Group) files, Office documents, and other types of files from fragments of compressed data is an invaluable capability for forensic analysis. In addition, bulk_extractor is able to automatically detect and parse encrypted RAR (Roshal Archive file), which further enhances its ability to handle complex forensic scenarios. With these features, bulk_extractor provides users with a comprehensive data extraction solution to discover key evidence during the digital forensics process.

[0060] S103: extracting feature information from the data stored in the buffer, and storing the feature information in a feature file;

[0061] In the specific implementation, feature information of great significance to the case is extracted from the data stored in the buffer, which may include email addresses in instant messaging, AES (Advanced Encryption Standard) keys and domain names stored in RAM (Random Access Memory) and other text files. This information is carefully screened and stored in a feature file, providing a key data foundation for subsequent in-depth analysis. The creation of feature files is a key step in digital forensics because it directly affects the accuracy and reliability of the analysis results.

[0062] bulk_extractor scans the forensic object and extracts the required information without parsing the file system or file system structure. It splits the input data into pages and processes one page on each available core. This means that a 24-core machine can process data about 24 times faster than a 1-core machine. The final results are stored in signature files that can be easily inspected, parsed, or processed using automated tools.

[0063] Furthermore, you can enable the wordlist module to generate a dictionary of suspicious passwords found in the data, and enable the exif (Exchangeable Image File Format) scanning module to locate suspicious image files included in the compressed file.

[0064] As a feasible implementation method, the buffer is a buffer of SBUFS structure; extracting feature information from the data stored in the buffer and storing the feature information in a feature file includes: using a scanner to scan the data in each SBUF and storing the extracted feature information in the feature file. In a specific implementation, the data is put into the SBUFS buffer structure, the scanner scans each SBUF (Safe Buffering), and the extracted features are stored in the feature file and the SQLite3 database.

[0065] S104: Process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a digital forensics result.

[0066] In the specific implementation, the feature file is further processed and converted into a histogram file. The histogram file is a data visualization tool that can display complex data information in a graphical way, allowing analysts to more intuitively identify patterns and anomalies in the data. By analyzing the feature file and the histogram file, the results of digital forensics can be obtained.

[0067] The digital forensics method provided in the embodiment of the present application uses the bulk_extractor tool for digital forensics. The bulk_extractor tool can automatically detect, decompress and recursively reprocess compressed data compressed using various algorithms, and is faster and more thorough. At the same time, the scanned objects are not limited to the memory images used in the related technology. The bulk_extractor tool can process any digital media, thereby improving the digital forensics effect.

[0068] The embodiment of the present application discloses a digital evidence collection method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically:

[0069] See also Figure 2 , according to a flowchart of a second digital forensics method shown in an exemplary embodiment, as shown in Figure 2 As shown, including:

[0070] S201: Determine a target device and obtain a forensic object of the target device;

[0071] The digital forensics method of this embodiment is applied to malware investigation.

[0072] S202: using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer;

[0073] S203: extracting executable file information and json information downloaded by the malware from the data stored in the buffer, and storing the extracted executable file information and json information downloaded by the malware into a feature file;

[0074] In the specific implementation, key information is extracted from the buffer, including executable file information and json (JavaScript Object Notation) information related to malware downloads. Based on the first 4KB of the file, all executable programs including those after compression are checked, and executable file information and json information of malware downloads are extracted through elf (Executable and Linkable Format), winpe (Windows Preinstallation Environment), winprefetch (Windows Prefetch file) and json scanning modules. The extracted executable file information may include static features such as file headers, entropy, and dynamic link libraries, while the json information may contain detailed information about the configuration of the malware and the command and control server. This information is stored in the feature file to provide a basis for subsequent analysis.

[0075] S204: Process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a malware investigation result.

[0076] In the specific implementation, the signature file is further processed into a histogram file, which helps to visualize and analyze the data. The histogram file can show the distribution of specific features, such as email addresses, URLs (Uniform Resource Locators), domain names, search keywords, etc. By analyzing the signature file and the histogram file, the behavior pattern, propagation path and potential impact of the malware can be obtained.

[0077] This embodiment can accurately identify and extract information related to malware, and use this information to build a behavior profile of the malware. The application of this method can greatly improve the efficiency and accuracy of malware investigation, thereby more effectively combating network threats.

[0078] The embodiment of the present application discloses a digital evidence collection method. Compared with the first embodiment, this embodiment further explains and optimizes the technical solution. Specifically:

[0079] See also Figure 3 , a flowchart of a third digital forensics method according to an exemplary embodiment is shown as follows: Figure 3 As shown, including:

[0080] S301: Determine a target device and obtain a forensic object of the target device;

[0081] The digital forensics method of this embodiment is applied to network investigation.

[0082] S302: using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer;

[0083] S303: extracting an encryption key, a hash value, and Ethernet related information from the data stored in the buffer, and storing the extracted encryption key, hash value, and Ethernet related information in a feature file;

[0084] Encryption keys are a critical element used in network communications to secure data transmission. In network investigations, extracting encryption keys can help investigators understand how data is encrypted and protected, and whether the attacker used weak keys or known keys. Using encryption algorithms such as AES, base16, base64, etc., encryption keys can be identified and extracted. These algorithms are commonly used in the encryption and decryption process of data, so by analyzing the implementation and use of these algorithms, encryption keys can be extracted.

[0085] A hash value is a unique identifier of fixed length obtained by processing data with a hash algorithm. In network investigations, hash values ​​can be used to identify and verify the integrity of files and track specific data flows in the network. By analyzing network traffic and related logs, hash values ​​can be extracted, which may be associated with known malware or other illegal activities.

[0086] Ethernet information includes MAC (Media Access Control) address, IP (Internet Protocol) address and protocol type, which are crucial to understanding the structure and path of network communication. Using windirs and net (Network) scanning modules, you can extract information such as source MAC address, destination MAC address and protocol type in Ethernet frames. This information helps track the transmission path of data packets in the network, identify abnormal traffic in the network, and associate specific network activities with physical devices.

[0087] S304: Process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a network survey result.

[0088] In a specific implementation, the extracted encryption keys, hash values, and Ethernet-related information are stored in signature files. These signature files are then processed into histogram files to facilitate analysis and visualization of the distribution of the data. Histogram files can help investigators quickly identify patterns and anomalies in the data, such as the frequency of use of a specific encryption key, the number of occurrences of a specific hash value, or the activity pattern of a specific MAC address. By analyzing these histograms, network investigation results can be obtained, providing direction for further investigation.

[0089] The digital forensics method of this embodiment provides an effective technical analysis method for network investigation by comprehensively analyzing encryption keys, hash values ​​and Ethernet-related information, which helps to reveal the complexity and dynamics of network attacks.

[0090] The embodiment of the present application discloses a digital evidence collection method. Compared with the first embodiment, this embodiment further explains and optimizes the technical solution. Specifically:

[0091] See also Figure 4 , a flowchart of a fourth digital forensics method according to an exemplary embodiment is shown, as shown in Figure 4 As shown, including:

[0092] S401: Determine a target device and obtain a forensic object of the target device;

[0093] The digital forensics method of this embodiment is applied to identity investigation.

[0094] S402: using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer;

[0095] S403: extracting identity information from the data stored in the buffer, and storing the extracted identity information in a feature file;

[0096] In practice, the extraction of identity information is a crucial step in the digital forensics process. This information may include, but is not limited to, sensitive data such as phone numbers, credit card numbers, and email addresses. In order to effectively extract this information, forensic tools use regular expressions for matching and identification. Regular expressions are a powerful text matching tool that can identify and extract strings based on specific patterns. For example, a regular expression for a phone number may match a specific sequence of digits, while a regular expression for a credit card number will match a sequence of digits that matches the length and format of a credit card number. Once the identity information is extracted, it is stored in a signature file. A signature file is a collection of all important identity information that can be used for subsequent analysis and investigation. Signature files are created to organize and index the extracted data to make it easier to analyze and retrieve.

[0097] S404: Process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain an identity investigation result.

[0098] In a specific implementation, in order to further analyze the extracted identity information, the feature file will be processed into a histogram file. A histogram file is a data visualization tool that can show the distribution of specific data. In identity investigations, histograms can help investigators identify the frequency and pattern of specific identity information, such as the frequency of a certain phone number or email address. By analyzing the feature file and the histogram file, investigators can obtain the results of the identity investigation. These results may reveal abnormal patterns in network access records or identity characteristics of the communication personnel. For example, if a phone number is associated with multiple different email addresses, this may indicate identity fraud or phishing activities. Through this analysis, investigators can better understand the behavioral patterns of cybercrime.

[0099] The digital evidence collection method of this embodiment provides an effective technical means for cyber crime investigation by extracting and analyzing identity information. The application of this method can greatly improve the efficiency and accuracy of investigation of identity theft and cyber fraud cases.

[0100] A digital forensics device provided in an embodiment of the present application is introduced below. The digital forensics device described below and the digital forensics method described above can be referenced to each other.

[0101] See also Figure 5 , a structural diagram of a digital evidence collection device according to an exemplary embodiment is shown, such as Figure 5 As shown, including:

[0102] An acquisition module 100 is used to determine a target device and acquire a forensic object of the target device;

[0103] The reading module 200 is used to read data from the forensic object using the bulk_extractor tool and store the read data in a buffer;

[0104] An extraction module 300 is used to extract feature information from the data stored in the buffer and store the feature information in a feature file;

[0105] The analysis module 400 is used to process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a digital forensics result.

[0106] The digital forensics device provided in the embodiment of the present application uses the bulk_extractor tool to perform digital forensics. The bulk_extractor tool can automatically detect, decompress and recursively reprocess compressed data compressed using various algorithms, and is faster and more thorough. At the same time, the scanned objects are not limited to the memory images used in the related technology. The bulk_extractor tool can process any digital media, thereby improving the digital forensics effect.

[0107] Based on the above embodiment, as a preferred implementation mode, the evidence acquisition object includes any combination of memory image, virtual memory file, virtual disk file, and image;

[0108] The reading module 200 is specifically used to use the bulk_extractor tool to allocate multiple threads to read data from multiple different forensic objects respectively.

[0109] Based on the above embodiment, as a preferred implementation mode, the reading module 200 is specifically used to: read data from the compressed file and / or encrypted file in the forensic object using the bulk_extractor tool.

[0110] Based on the above embodiment, as a preferred implementation mode, the buffer is a buffer of SBUFS structure;

[0111] The extraction module 300 is specifically used to: use a scanner to scan the data in each SBUF, and store the extracted feature information in a feature file.

[0112] Based on the above embodiment, as a preferred implementation, the extraction module 300 is specifically used to: extract executable file information and json information downloaded by malware from the data stored in the buffer;

[0113] Accordingly, the analysis module 400 is specifically used to analyze the feature file and the histogram file to obtain malware investigation results.

[0114] Based on the above embodiment, as a preferred implementation, the extraction module 300 is specifically used to: extract the encryption key, hash value and Ethernet related information from the data stored in the buffer;

[0115] Correspondingly, the analysis module 400 is specifically used to analyze the feature file and the histogram file to obtain the network investigation result.

[0116] Based on the above embodiment, as a preferred implementation, the extraction module 300 is specifically used to: extract identity information from the data stored in the buffer;

[0117] Accordingly, the analysis module 400 is specifically used to analyze the feature file and the histogram file to obtain the identity investigation result.

[0118] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0119] Based on the hardware implementation of the above program module, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device, Figure 6 FIG. 1 is a structural diagram of an electronic device according to an exemplary embodiment. Figure 6 As shown, the electronic equipment includes:

[0120] Communication interface 1, capable of exchanging information with other devices such as network devices;

[0121] The processor 2 is connected to the communication interface 1 to realize information exchange with other devices and is used to execute the digital forensics method provided by one or more technical solutions when running a computer program. The computer program is stored in the memory 3.

[0122] Of course, in actual application, the various components in the electronic device are coupled together through the bus system 4. It can be understood that the bus system 4 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 4 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 6 Various buses are labeled as bus system 4.

[0123] The memory 3 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0124] It can be understood that the memory 3 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 3 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0125] The method disclosed in the above embodiment of the present application can be applied to the processor 2, or implemented by the processor 2. The processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 2 or the instruction in the form of software. The above processor 2 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 3, and the processor 2 reads the program in the memory 3 and completes the steps of the above method in combination with its hardware.

[0126] When the processor 2 executes the program, the corresponding processes in the various methods of the embodiments of the present application are implemented, which will not be repeated here for the sake of brevity.

[0127] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory 3 storing a computer program, and the computer program can be executed by a processor 2 to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, CD-ROM, etc.

[0128] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0129] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for an electronic device (which can be a personal computer, server, network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

[0130] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A digital forensics method, characterized in that: include: Determine a target device and obtain a forensic object of the target device; Using the bulk_extractor tool to read data from the forensic object, and storing the read data in a buffer; Extracting feature information from the data stored in the buffer, and storing the feature information in a feature file; The feature file is processed into a histogram file, and the feature file and the histogram file are analyzed to obtain a digital forensics result.

2. The digital forensics method according to claim 1, characterized in that: The evidence collection object includes any combination of memory images, virtual memory files, virtual disk files, and images; The method of using the bulk_extractor tool to read data from the forensic object includes: Use the bulk_extractor tool to allocate multiple threads to read data from multiple different forensic objects.

3. The digital forensics method according to claim 1, characterized in that: The method of using the bulk_extractor tool to read data from the forensic object includes: The bulk_extractor tool is used to read data from the compressed files and / or encrypted files in the forensic object.

4. The digital forensics method according to claim 1, characterized in that: The buffer is a buffer of SBUFS structure; Extracting feature information from the data stored in the buffer and storing the feature information in a feature file includes: The data in each SBUF is scanned by a scanner, and the extracted feature information is stored in a feature file.

5. The digital forensics method according to claim 1, characterized in that: Extracting feature information from the data stored in the buffer includes: Extracting executable file information and json information downloaded by malware from the data stored in the buffer; Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes: The feature file and the histogram file are analyzed to obtain malware investigation results.

6. The digital forensics method according to claim 1, characterized in that: Extracting feature information from the data stored in the buffer includes: extracting encryption keys, hash values ​​and Ethernet related information from the data stored in the buffer; Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes: The characteristic file and the histogram file are analyzed to obtain network survey results.

7. The digital forensics method according to claim 1, characterized in that: Extracting feature information from the data stored in the buffer includes: extracting identity information from the data stored in the buffer; Accordingly, the analyzing the feature file and the histogram file to obtain a digital forensics result includes: The feature file and the histogram file are analyzed to obtain identity investigation results.

8. A digital evidence collection device, characterized in that: include: An acquisition module, used to determine a target device and acquire a forensic object of the target device; A reading module, used to read data from the forensic object using a bulk_extractor tool, and store the read data in a buffer; An extraction module, used for extracting feature information from the data stored in the buffer, and storing the feature information in a feature file; The analysis module is used to process the feature file into a histogram file, and analyze the feature file and the histogram file to obtain a digital forensics result.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the digital forensics method as claimed in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed, implements the steps of the digital forensics method according to any one of claims 1 to 7.

Images