Wi-Fi parallel evidence obtaining method and device

Abstract

The invention relates to a Wi-Fi parallel evidence obtaining method and device, and the method comprises the steps: enabling each cellphone to be subjected to evidence obtaining to be paired with Wi-Fi equipment to form an evidence obtaining group, and generating a to-be-transmitted file set; if the file set is not empty, activating a related evidence obtaining group, creating a Wi-Fi multi-thread transmission object, and selecting channel isolation configuration to create a pure Wi-Fi network environment; the number of threads is dynamically adjusted based on the maximum transmission rate of the network environment, and the data transmission speed is optimized; in the transmission process, a CRC algorithm, an MD5 algorithm or an SHA algorithm is adopted to calculate a check value to ensure data integrity. The hardware isolation device is used for reducing interference among different evidence obtaining groups, and the transmission efficiency is further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic evidence collection, and in particular to a Wi-Fi parallel evidence collection method and device. Background Art

[0002] In the earlier process of electronic data forensics on mobile phones, most of them used USB data cable communication protocol, mobile phone mirroring tools to make images and then analyze them, Bluetooth communication protocol, and infrared communication protocol to obtain data; with the development of informatization, the Android system has become one of the most widely used mobile operating systems in the world. Android phones have a high global market share and are an important target for electronic data forensics. The continuously strengthened data security and privacy setting functions of the Android operating system, the increasing data storage capacity, the rich and diverse mobile App applications, and the optimization of system functions, such as Android 10 canceled the adb backup function, and the backup and reset options in the Android 11 device menu were also removed. Android 12 strengthened privacy settings and controls, allowing users to more easily manage their personal information and application permissions, while adding new security features to protect user data from unauthorized access, etc., all of which make mobile phone electronic data forensics face increasingly severe challenges in data acquisition. At present, the industry mainly uses USB mobile phone direct connection to obtain data through the ADB protocol, or uses Wi-Fi mobile phone backup or mobile phone cloning solutions for data backup and analysis. However, existing technologies only focus on using the manufacturer's own protocols or tools to clone and obtain data. When faced with a large amount of mobile phone data and a large mobile phone data capacity, they cannot meet customers' requirements for data acquisition speed. Summary of the invention

[0003] In order to solve the above problems, the present invention proposes a Wi-Fi parallel forensics method and device, which is suitable for electronic data forensics on Android 12 and higher mobile phones or tablets. Based on the existing mobile phone moving and mobile phone cloning methods, Wi-Fi multi-channel parallel transmission is used to improve the data acquisition speed.

[0004] The specific plan is as follows:

[0005] In one aspect, a Wi-Fi parallel forensics method includes:

[0006] S1, obtain all mobile phones to be collected; pair each mobile phone to be collected with a Wi-Fi device to form a collection group; based on all mobile phones to be collected, generate a collection group set including all mobile phones to be collected and paired Wi-Fi devices;

[0007] S2, obtaining the files to be transferred by the mobile phone to be collected in each collection group in the collection group set; generating a collection of files to be transferred including all collection groups;

[0008] S3, if the set of files to be transferred is not empty, activate the relevant forensic group, create a Wi-Fi multi-threaded transfer object, and enable the channel isolation configuration selection;

[0009] S4, the relevant forensics team initiates channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment;

[0010] S5, the Wi-Fi multi-threaded transmission object in the relevant forensic group analyzes the maximum file transfer rate supported by the pure Wi-Fi network environment; dynamically adjusts the number of threads based on the maximum file transfer rate, and transmits the files to be transferred in the mobile phone to be forensically collected to the external receiving device through the Wi-Fi device.

[0011] Furthermore, in S1, pairing each mobile phone to be collected with a Wi-Fi device specifically includes:

[0012] Establish a data connection between the mobile phone of each forensic group and the paired Wi-Fi device hotspot, so that each forensic group in the forensic group set can be interconnected via Wi-Fi.

[0013] Furthermore, each forensic team's mobile phone is connected to the paired Wi-Fi device hotspot to establish a data connection, including:

[0014] Establish a connection by scanning a QR code or automatically connecting to Wi-Fi.

[0015] Further, in S3, the channel isolation for configuration selection includes Wi-Fi channel soft isolation, Wi-Fi channel hard isolation, and Wi-Fi channel hybrid isolation;

[0016] The Wi-Fi channel soft isolation creates a pure Wi-Fi transmission environment by enabling the 5GHz frequency band and ensuring that all devices in the forensic group support this frequency band, and enabling the automatic channel selection function of the Wi-Fi device to automatically select channels that do not interfere with each other;

[0017] The Wi-Fi channel hard isolation creates a pure Wi-Fi network environment by isolating the forensic groups in the forensic group set using hardware isolation devices;

[0018] The Wi-Fi channel hybrid isolation creates a pure Wi-Fi transmission environment by simultaneously enabling Wi-Fi channel soft isolation and Wi-Fi channel hard isolation.

[0019] Further, isolating the evidence collection groups in the evidence collection group set by using hardware isolation devices respectively, specifically includes:

[0020] The mobile phones to be collected and the Wi-Fi devices belonging to the same evidence collection group are placed together in a hardware isolation box with the function of isolating Wi-Fi signals. The hardware isolation box has a reserved network cable interface for connecting the Wi-Fi device inside the isolation box and the external receiving device. The mobile phones to be collected in the evidence collection group transmit the files to be transmitted to the external receiving device via the Wi-Fi device.

[0021] Furthermore, in S5, dynamically adjusting the number of threads based on the maximum file transfer rate specifically includes:

[0022] Measure the maximum bandwidth and actual transmission rate in a pure Wi-Fi network environment, create and manage the initial thread through the Wi-Fi multi-threaded transmission object, and monitor the transmission performance in real time. Dynamically increase or decrease the number of threads according to the monitored network conditions until the optimal number of threads is found to maximize the transmission rate.

[0023] Furthermore, in S5, when the file to be transmitted in the mobile phone to be collected is transmitted to the external receiving device via the Wi-Fi device, the transmitted data is verified by the check value. If the check value matches, the data is determined to be accurate, and the receiver accepts and saves the data. If the check value does not match, the receiver requests the sender to resend the data.

[0024] Furthermore, the transmitted data is verified by the check value, including:

[0025] S51, the mobile phone to be forensically collected calculates the file data to be transmitted through a data integrity verification algorithm to obtain a first check value;

[0026] S52, the mobile phone to be forensically collected combines the file data to be transmitted and the check value into a data packet, and transmits the data packet to an external receiving device via a Wi-Fi device;

[0027] S53, the external receiving device parses the combined data packet, calculates the file data to be transmitted through a data integrity verification algorithm, obtains a second check value, and determines whether the second check value matches the first check value;

[0028] S54, if the check values ​​match, the data is determined to be accurate, and the external receiving device accepts and saves the data; if the check values ​​do not match, the data is determined to be tampered with or damaged, and the external receiving device requests the mobile phone to be collected to resend the file data.

[0029] 9. The Wi-Fi parallel forensics method according to claim 8, wherein the data integrity verification algorithm includes CRC, MD5 or SHA.

[0030] In another aspect, a Wi-Fi parallel forensics device includes:

[0031] The forensic group pairing module obtains all the mobile phones to be collected; pairs each mobile phone to be collected with a Wi-Fi device to form a forensic group; based on all the mobile phones to be collected, generates a forensic group set containing all the mobile phones to be collected and the paired Wi-Fi devices;

[0032] The module for acquiring files to be transferred acquires the files to be transferred by the mobile phone to be collected in each collection group in the collection group set; and generates a collection of files to be transferred that includes all collection groups;

[0033] The relevant forensic group activation module activates the relevant forensic group if the set of files to be transferred is not empty, creates a Wi-Fi multi-threaded transfer object, and enables the channel isolation configuration selection;

[0034] The channel isolation configuration selection module is used by the relevant forensics team to initiate channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment;

[0035] The data transmission module is used to analyze the maximum file transfer rate supported by a pure Wi-Fi network environment for Wi-Fi multi-threaded transmission objects in the relevant forensic group; dynamically adjust the number of threads based on the maximum file transfer rate, and transfer the files that need to be transferred in the mobile phone to be collected to the external receiving device through the Wi-Fi device.

[0036] The present invention adopts the above technical solution and has the following beneficial effects:

[0037] (1) The present invention effectively reduces Wi-Fi signal interference between different forensic groups and creates a purer data transmission environment by adopting a variety of channel isolation configuration schemes including soft isolation (such as enabling the 5 GHz frequency band and automatically selecting non-interfering channels), hard isolation (using hardware isolation devices) and hybrid isolation;

[0038] (2) The present invention dynamically adjusts the number of threads according to the maximum file transfer rate that can be supported in the current Wi-Fi network environment to achieve optimal transmission performance, thereby maximizing the maximum bandwidth and ensuring maximum data transmission efficiency;

[0039] (3) The present invention introduces a check value mechanism in the data transmission process, uses CRC, MD5 and SHA algorithms to calculate the check value of the file to be transmitted, and performs comparison and verification at the receiving end, thereby ensuring the integrity and accuracy of the data during the transmission process and preventing the data from being tampered with or damaged. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flow chart of a Wi-Fi parallel evidence collection method according to an embodiment of the present invention;

[0041] Figure 2 is a schematic diagram of an isolation device according to an embodiment of the present invention;

[0042] Figure 3 A Wi-Fi parallel evidence collection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0044] like Figure 1 As shown, the present invention provides a Wi-Fi parallel evidence collection method, comprising:

[0045] S1, obtain all mobile phones to be collected; pair each mobile phone to be collected with a Wi-Fi device to form a collection group; based on all mobile phones to be collected, generate a collection group set including all mobile phones to be collected and paired Wi-Fi devices.

[0046] Specifically, pairing each mobile phone to be collected with a Wi-Fi device includes:

[0047] Establish a data connection between the mobile phone of each forensic group and the paired Wi-Fi device hotspot, so that each forensic group in the forensic group set can be interconnected via Wi-Fi.

[0048] Specifically, establish a data connection between each forensic team's mobile phone and the paired Wi-Fi device hotspot, including:

[0049] Establish a connection by scanning a QR code or automatically connecting to Wi-Fi

[0050] S2, obtaining files that need to be transferred by the mobile phone to be collected in each collection group in the collection group set; and generating a collection of files to be transferred that includes all collection groups.

[0051] S3, if the set of files to be transferred is not empty, activate the relevant forensic group, create a Wi-Fi multi-threaded transfer object, and enable the channel isolation configuration selection.

[0052] Specifically, the channel isolation options available for configuration include Wi-Fi channel soft isolation, Wi-Fi channel hard isolation, and Wi-Fi channel hybrid isolation;

[0053] The Wi-Fi channel soft isolation creates a pure Wi-Fi transmission environment by enabling the 5GHz frequency band and ensuring that all devices in the forensic group support this frequency band, and enabling the automatic channel selection function of the Wi-Fi device to automatically select channels that do not interfere with each other;

[0054] The Wi-Fi channel hard isolation creates a pure Wi-Fi network environment by isolating the forensic groups in the forensic group set using hardware isolation devices;

[0055] The Wi-Fi channel hybrid isolation creates a pure Wi-Fi transmission environment by simultaneously enabling Wi-Fi channel soft isolation and Wi-Fi channel hard isolation.

[0056] Specifically, isolating the evidence collection groups in the evidence collection group set by using hardware isolation devices respectively includes:

[0057] The mobile phones to be collected and the Wi-Fi devices belonging to the same evidence collection group are placed together in a hardware isolation box with the function of isolating Wi-Fi signals. The hardware isolation box has a reserved network cable interface for connecting the Wi-Fi device inside the isolation box and the external receiving device. The mobile phones to be collected in the evidence collection group transmit the files to be transmitted to the external receiving device via the Wi-Fi device.

[0058] like Figure 2 The hardware isolation box of an embodiment of the present invention is shown, which mainly serves as a pure Wi-Fi signal environment, wherein (1) is the mobile phone and Wi-Fi device (such as a wireless network card) of the relevant evidence collection group 1 placed in the isolation device, and (2) is the mobile phone and Wi-Fi device (such as a wireless network card) of the relevant evidence collection group 2 placed in the isolation device.

[0059] S4, the relevant forensic team initiates channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment.

[0060] S5, the Wi-Fi multi-threaded transmission object in the relevant forensic group analyzes the maximum file transfer rate supported by the pure Wi-Fi network environment; dynamically adjusts the number of threads based on the maximum file transfer rate, and transmits the files to be transferred in the mobile phone to be forensically collected to the external receiving device through the Wi-Fi device.

[0061] Specifically, dynamically adjusting the number of threads based on the maximum file transfer rate includes:

[0062] Measure the maximum bandwidth and actual transmission rate in a pure Wi-Fi network environment, create and manage the initial thread through the Wi-Fi multi-threaded transmission object, and monitor the transmission performance in real time. Dynamically increase or decrease the number of threads according to the monitored network conditions until the optimal number of threads is found to maximize the transmission rate.

[0063] Specifically, when the file to be transferred from the mobile phone to be collected is transmitted to the external receiving device via the Wi-Fi device, the transmitted data is verified by the check value. If the check value matches, the data is determined to be accurate, and the receiver accepts and saves the data. If the check value does not match, the receiver requests the sender to resend the data.

[0064] Specifically, the transmission data is verified by the check value, including:

[0065] S51, the mobile phone to be forensically collected calculates the file data to be transmitted through a data integrity verification algorithm to obtain a first check value;

[0066] S52, the mobile phone to be forensically collected combines the file data to be transmitted and the check value into a data packet, and transmits the data packet to an external receiving device via a Wi-Fi device;

[0067] S53, the external receiving device parses the combined data packet, calculates the file data to be transmitted through a data integrity verification algorithm, obtains a second check value, and determines whether the second check value matches the first check value;

[0068] S54, if the check values ​​match, the data is determined to be accurate, and the external receiving device accepts and saves the data; if the check values ​​do not match, the data is determined to be tampered with or damaged, and the external receiving device requests the mobile phone to be collected to resend the file data.

[0069] Specifically, the data integrity verification algorithm includes CRC, MD5 or SHA.

[0070] In general, in order to solve the problem of data tampering or damage during data transmission, the Android phone is the data sender, the Wi-Fi device creates a network transmission environment, and the computer receives the Wi-Fi data; a check value is calculated before the data is sent, and the value is recalculated at the receiving end for comparison to verify the integrity of the data.

[0071] Specifically, the following resources are selected for testing in this embodiment: network card: PCIE wireless network card / Qualcomm NFA765 / WIFI 6E / 2.4G and 5G dual-band, test mobile phones: Huawei Mate 60 and OPPO FIND 6X PRO and first-generation Wi-Fi devices.

[0072] Table 1: Results of single-path forensic testing

[0073]

[0074] Table 2: Two-way parallel evidence collection

[0075]

[0076] Table 3: Two-way parallel evidence collection, isolated from each other

[0077]

[0078] It can be seen from Tables 1, 2 and 3 that when the isolation device is not placed, the channel interference caused by the two-way parallel evidence collection will cause the file data transmission rate to decrease and the evidence collection rate to decrease. When the isolation device is placed, the average speed of parallel evidence collection is significantly improved.

[0079] like Figure 3 As shown, this embodiment also discloses a Wi-Fi parallel evidence collection device, including:

[0080] The evidence collection group pairing module 31 obtains all the mobile phones to be collected; pairs each mobile phone to be collected with a Wi-Fi device to form a evidence collection group; based on all the mobile phones to be collected, generates a collection group set including all the mobile phones to be collected and the paired Wi-Fi devices;

[0081] The to-be-transmitted file acquisition module 32 acquires the files to be transmitted by the mobile phone to be collected in each collection group in the collection group set; and generates a collection of to-be-transmitted files including all collection groups;

[0082] The relevant forensic group activation module 33 activates the relevant forensic group if the set of files to be transferred is not empty, creates a Wi-Fi multi-threaded transmission object, and enables channel isolation configuration selection;

[0083] A channel isolation configuration selection module 34 is used for the relevant forensics group to initiate channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment;

[0084] The data transmission module 35 is used for analyzing the maximum file transfer rate supported by a pure Wi-Fi network environment for the Wi-Fi multi-threaded transmission object in the relevant evidence collection group; dynamically adjusting the number of threads based on the maximum file transfer rate, and transmitting the files to be transferred in the mobile phone to be collected to an external receiving device via a Wi-Fi device.

[0085] The specific implementation of a Wi-Fi parallel evidence collection device is the same as the Wi-Fi parallel evidence collection method, and this embodiment will not be repeated.

[0086] Although the present invention has been specifically shown and described in conjunction with the preferred embodiments, it should be understood by those skilled in the art that various changes may be made to the present invention in form and details without departing from the spirit and scope of the present invention as defined by the appended claims, all of which are within the scope of protection of the present invention.

Claims

1. A Wi-Fi parallel forensics method, characterized in that: include: S1, obtain all mobile phones to be collected; Pair each mobile phone to be collected with a Wi-Fi device to form a collection group; based on all the mobile phones to be collected, generate a collection group set that includes all the mobile phones to be collected and the paired Wi-Fi devices; S2, obtaining the files to be transferred by the mobile phone to be collected in each collection group in the collection group set; generating a collection of files to be transferred including all collection groups; S3, if the set of files to be transferred is not empty, activate the relevant forensic group, create a Wi-Fi multi-threaded transfer object, and enable the channel isolation configuration selection; S4, the relevant forensics team initiates channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment; S5, the Wi-Fi multi-threaded transmission object in the relevant forensics group analyzes the maximum file transfer rate supported by a pure Wi-Fi network environment; The number of threads is dynamically adjusted based on the maximum file transfer rate, and the files to be transferred in the mobile phone to be forensically collected are transmitted to the external receiving device via the Wi-Fi device.

2. The Wi-Fi parallel forensics method according to claim 1, characterized in that: In S1, pairing each mobile phone to be collected with a Wi-Fi device specifically includes: Establish a data connection between the mobile phone of each forensic group and the paired Wi-Fi device hotspot, so that each forensic group in the forensic group set can be interconnected via Wi-Fi.

3. The Wi-Fi parallel evidence collection method according to claim 2, characterized in that: Establish a data connection between each forensic team's mobile phone and the paired Wi-Fi device hotspot, including: Establish a connection by scanning a QR code or automatically connecting to Wi-Fi.

4. The Wi-Fi parallel evidence collection method according to claim 1, characterized in that: In S3, the channel isolation options available for configuration include Wi-Fi channel soft isolation, Wi-Fi channel hard isolation, and Wi-Fi channel hybrid isolation; The Wi-Fi channel soft isolation creates a pure Wi-Fi transmission environment by enabling the 5GHz frequency band and ensuring that all devices in the forensic group support this frequency band, and enabling the automatic channel selection function of the Wi-Fi device to automatically select channels that do not interfere with each other; The Wi-Fi channel hard isolation creates a pure Wi-Fi network environment by isolating the forensic groups in the forensic group set using hardware isolation devices; The Wi-Fi channel hybrid isolation creates a pure Wi-Fi transmission environment by simultaneously enabling Wi-Fi channel soft isolation and Wi-Fi channel hard isolation.

5. The Wi-Fi parallel evidence collection method according to claim 4, characterized in that: The forensic groups in the forensic group set are isolated by hardware isolation devices respectively, specifically including: The mobile phones to be collected and the Wi-Fi devices belonging to the same evidence collection group are placed together in a hardware isolation box with the function of isolating Wi-Fi signals. The hardware isolation box has a reserved network cable interface for connecting the Wi-Fi device inside the isolation box and the external receiving device. The mobile phones to be collected in the evidence collection group transmit the files to be transmitted to the external receiving device via the Wi-Fi device.

6. The Wi-Fi parallel evidence collection method according to claim 1, characterized in that: In S5, dynamically adjusting the number of threads based on the maximum file transfer rate specifically includes: Measure the maximum bandwidth and actual transmission rate in a pure Wi-Fi network environment, create and manage the initial thread through the Wi-Fi multi-threaded transmission object, and monitor the transmission performance in real time. Dynamically increase or decrease the number of threads according to the monitored network conditions until the optimal number of threads is found to maximize the transmission rate.

7. The Wi-Fi parallel evidence collection method according to claim 1, characterized in that: In S5, when the file to be transferred from the mobile phone to be forensically collected is transmitted to the external receiving device via the Wi-Fi device, the transmitted data is verified by the check value. If the check value matches, the data is determined to be accurate, and the receiver accepts the data and saves it. If the check value does not match, the receiver requests the sender to resend it.

8. The Wi-Fi parallel evidence collection method according to claim 7, characterized in that: The transmission data is verified by the checksum value, including: S51, the mobile phone to be forensically collected calculates the file data to be transmitted through a data integrity verification algorithm to obtain a first check value; S52, the mobile phone to be forensically collected combines the file data to be transmitted and the check value into a data packet, and transmits the data packet to an external receiving device via a Wi-Fi device; S53, the external receiving device parses the combined data packet, calculates the file data to be transmitted through a data integrity verification algorithm, obtains a second check value, and determines whether the second check value matches the first check value; S54, if the check values ​​match, the data is determined to be accurate, and the external receiving device accepts and saves the data; if the check values ​​do not match, the data is determined to be tampered with or damaged, and the external receiving device requests the mobile phone to be collected to resend the file data.

9. The Wi-Fi parallel evidence collection method according to claim 8, characterized in that: The data integrity verification algorithm includes CRC, MD5 or SHA.

10. A Wi-Fi parallel evidence collection device, characterized in that: include: The forensic group pairing module obtains all mobile phones to be collected; Pair each mobile phone to be collected with a Wi-Fi device to form a collection group; based on all the mobile phones to be collected, generate a collection group set that includes all the mobile phones to be collected and the paired Wi-Fi devices; The module for acquiring files to be transferred acquires the files to be transferred by the mobile phone to be collected in each collection group in the collection group set; and generates a collection of files to be transferred that includes all collection groups; The relevant forensic group activation module activates the relevant forensic group if the set of files to be transferred is not empty, creates a Wi-Fi multi-threaded transmission object, and enables the channel isolation configuration selection; The channel isolation configuration selection module is used by the relevant forensics team to initiate channel isolation based on the configuration selection to obtain a pure Wi-Fi network environment; Data transmission module, used for Wi-Fi multi-threaded transmission object analysis in related forensics groups to determine the maximum file transfer rate supported by a pure Wi-Fi network environment; The number of threads is dynamically adjusted based on the maximum file transfer rate, and the files to be transferred in the mobile phone to be forensically collected are transmitted to the external receiving device via the Wi-Fi device.

Images