Electronic data evidence obtaining method and system, electronic equipment and storage medium

Abstract

According to the electronic data evidence obtaining method and system, the electronic equipment and the storage medium, mirror image files are analyzed through a file management system, metadata information of all the files is obtained, and a file tree is constructed according to the metadata information and stored in a memory; judging whether the file analysis module supports data input into a memory or not, if yes, searching metadata information of a target file needing to be analyzed from the file tree, and obtaining the target file from the mirror image file according to the metadata information of the target file for analysis; and if not, mounting the file tree into a local directory through an application layer file system driver, searching metadata information of the target file from the local directory, and obtaining the target file from the mirror image file according to the metadata information of the target file for analysis. According to the invention, efficient interaction among a plurality of evidence obtaining system modules can be realized, and the purpose of efficient access without exporting the mirror image file is achieved.

Description

Technical Field

[0001] The present invention relates to the field of electronic data forensics, and in particular to an electronic data forensics method, system, electronic equipment and storage medium. Background Art

[0002] Electronic data forensics requires data structure analysis of files in various formats and presenting them to users in an intuitive manner. Due to the large number of formats involved, it is difficult for a single forensic system to fully meet the needs of forensics, so multiple forensic systems or forensic modules are often required to collaborate with each other.

[0003] Currently, many interactions between system modules are passed with file paths as parameters, which involves operations such as exporting files from images or virtualizing file paths based on application-layer file systems. For file export from images, it involves reading and writing, and is limited by the target disk IO to be written, so the overall performance is low and uncontrollable; and when using the application-layer file system, each read interaction will take twice as long as conventional IO in terms of intermediate process loss, and the overall efficiency is not high. Summary of the invention

[0004] The main purpose of the present invention is to overcome the low efficiency defect of multi-system collaborative forensics based on file paths in the prior art, and to propose an electronic data forensics method, system, electronic device and storage medium, which do not require the export of image files and eliminate the interaction loss on the application layer file system IO, so as to achieve the purpose of efficient forensics.

[0005] The present invention adopts the following technical solution:

[0006] An electronic data forensics method, comprising:

[0007] Parse the image file through the file management system, obtain the metadata information of all files, build a file tree based on the metadata information and store it in the memory;

[0008] Determine whether the file parsing module supports the data input into the memory; if so, search the metadata information of the target file to be parsed from the file tree, and obtain the target file from the image file for parsing according to the metadata information of the target file; if not, mount the file tree into a local directory through the application layer file system driver, and search the metadata information of the target file from the local directory; the file parsing module obtains the target file from the image file for parsing according to the metadata information of the target file.

[0009] Furthermore, the metadata information includes a data sector map, which represents the distribution of the file in the image file, and the target file is obtained from the image file according to the data sector map in the metadata information of the target file.

[0010] Furthermore, the data sector map adopts a linked list, and each node of the linked list records the starting sector and the number of sectors of the file content; when obtaining the target file, reading starts from the starting sector of the node where the target file is located, combined with the number of sectors until the target file is read.

[0011] Furthermore, the metadata information includes parent directory information, and the file tree is constructed through the parent directory information; metadata information of the target file to be parsed is searched according to the parent directory information of the file tree or the local directory.

[0012] Furthermore, the file management system also obtains the paths of all files in the image file; when the application layer file system driver mounts the file tree into a local directory, a mapping relationship between the complete path of the file and the metadata information and the path of the file in the image file is established in the driver memory; by opening the complete path of the target file, the metadata information of the target file is obtained according to the mapping relationship.

[0013] Furthermore, the complete path of the file includes the mounted local path and the path of the file in the image file.

[0014] An electronic data forensics system, comprising:

[0015] The file management system is used to parse the image files, obtain the metadata information of all files, build a file tree based on the metadata information and store it in the memory;

[0016] A file parsing module searches for metadata information of a target file to be parsed from the file tree or searches for metadata information of a target file through the local directory, and obtains the target file from the image file for parsing according to the metadata information of the target file;

[0017] The application layer file system driver is used to mount the file tree into a local directory when the file parsing module does not support input memory data.

[0018] An electronic device, characterized in that it comprises: a memory on which a computer program is stored; and a processor for executing the computer program in the memory to implement the steps of the above method.

[0019] A computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0020] It can be seen from the above description of the present invention that, compared with the prior art, the present invention has the following beneficial effects:

[0021] The present invention proposes an efficient electronic data forensics technology framework, which first obtains metadata information of all files through file management system analysis, builds a file tree according to parent directory information, and then selects different data access methods according to the input conditions supported by the file parsing module. It can realize efficient interaction between multiple forensics system modules and achieve the purpose of efficient access to image files without exporting them.

[0022] When the file parsing module does not support inputting memory data, the parsed meta-information is passed to the application layer file system driver. The application layer file system driver directly reads data based on the file meta-information, thereby eliminating the interaction loss on the application layer file system driver IO and improving the efficiency of forensics.

[0023] The file system parsing technology of the present invention is effectively combined with the application layer file system technology, which solves the low efficiency problem of traditional technologies such as exporting files from images or directly virtualizing file paths based on application layer file systems. It is of great significance to improve the efficiency of electronic data forensics systems, can be applied to various data processing systems, and has a wide range of application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is the principle diagram of the method of the present invention;

[0025] Figure 2 It is the main flow chart of the present invention;

[0026] Figure 3 This is a flowchart of the application layer file system forensics processing of the present invention.

[0027] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. DETAILED DESCRIPTION

[0028] The present invention is further described below through specific implementation modes.

[0029] See also Figure 1 and Figure 2 , an electronic data forensics method, comprising the following steps:

[0030] S1 parses the image file through the file management system, obtains the metadata information of all files, builds a file tree based on the metadata information and stores it in the memory.

[0031] The file management system is a system that implements file management at the driver level. The file management system is used to parse the image file to obtain metadata information. The metadata information of all files obtained includes file name, size, time, data sector map, parent directory information, etc. The data sector map represents the distribution of files in the image file. The data sector is a linked list, and each node in the linked list records the starting sector and number of sectors of the file content. The parent directory is the upper-level directory where a file or directory is located, which can be an ID or an offset address.

[0032] The file management system maintains metadata information in the memory in the form of a file tree according to the directory structure. Specifically, the file tree is constructed based on the parent directory information. For example, files with the same parent directory information are mounted under the same parent directory. The constructed file tree is stored in the memory. The parent directory information in the memory is a pointer that directly points to the node where the parent directory is located. The path of the file in the image file is also generated by traversing the file tree.

[0033] S2 determines whether the file parsing module supports the data input into the memory. If so, it searches for the metadata information of the target file to be parsed from the file tree, obtains the target file from the image file according to the metadata information of the target file, and sends it to the file parsing module for parsing; if not, the file tree is mounted as a local directory through the application layer file system driver, and the metadata information of the target file is searched from the local directory; the file parsing module obtains the target file from the image file according to the metadata information of the target file for parsing.

[0034] In this step, first determine whether the file parsing module supports the data input into the memory. If so, the file parsing module directly searches for the metadata information of the target file in the memory, and can search for the metadata information of the target file to be parsed based on the parent directory information in the metadata information of the target file.

[0035] Specifically, first search for the metadata information of the target file in the file tree according to the parent directory information of the target file. For example, if the path of the file in the image file is C:\test\1.db, the file path of the target file is decomposed into C, test, and 1.db, and the node named C is searched under the root node of the file tree. After finding it, search for the test node under the C node, and then search for the 1.db node under the test node.

[0036] If the file parsing module does not support reading data from memory, it needs to be processed in conjunction with the application layer file system. Use the application layer file system to mount the file tree to a local directory, that is, mount the virtual file tree in memory locally, and make it the same as a local regular directory. After mounting, the full path of the file includes the mounted local path + the path of the file in the image file. For example, if the path in the image file to be parsed is D:\test\1.db, and the mounted local directory is C:\temp, then the full path of the file is equal to C:\temp\D\test\1.db.

[0037] See also Figure 3 , when the file tree is mounted locally, when the mounted local directory is opened, the corresponding metadata information in the file tree is passed in. The application layer file system driver also establishes a mapping relationship between the full path of the file and the metadata information and the path of the file in the image file in the driver memory. The file parsing module opens the full path of the target file to find the metadata information of the target file. Specifically, the full path of the target file is first opened through the system API, and then the metadata information of the target file is obtained according to the mapping relationship.

[0038] The file parsing module obtains the target file from the image file for parsing according to the metadata information of the target file. When obtaining the target file, the target file is obtained according to the data sector map in the metadata information. Specifically, reading starts from the starting sector of the node where the target file is located, and the number of sectors is combined until the target file is read. For example, the starting sector of the first node of the linked list of the sector map of the target file is startSector, and the number of sectors is SectorNum. When reading data, it will start from the position of startSector*sector size (generally 512). If the read size exceeds SectorNum*512, it will go to the next node in the linked list for reading until the reading is completed.

[0039] Based on this, the present invention also proposes an electronic data forensics system, which adopts the above-mentioned electronic data forensics method and includes the following modules:

[0040] The file management system is used to parse the image file, obtain the metadata information of all files, build a file tree based on the metadata information and store it in the memory. This module is used to execute the above step S1.

[0041] The file parsing module, for those that support input memory data, can search for metadata information of the target file to be parsed from the file tree; while for those that do not support input memory data, it searches for metadata information of the target file through the local directory. The file parsing module also obtains the target file from the image file for parsing based on the metadata information of the target file.

[0042] Application layer file system driver, this module is used to mount the file tree into a local directory when the file parsing module does not support input memory data, so that the subsequent file parsing module can obtain the metadata information of the target file.

[0043] In the present invention, the file parsing module and the application layer file system driver are used to execute the above method step S2.

[0044] The method and system of the present invention propose an efficient electronic data forensics technology framework, which first obtains metadata information of all files through file management system analysis, builds a file tree according to parent directory information, and then selects different data access methods according to the input conditions supported by the file parsing module. It can realize efficient interaction between multiple forensics system modules, and achieve the purpose of efficient access to image files without exporting.

[0045] An electronic device comprises: a memory on which a computer program is stored; and a processor for executing the computer program in the memory to implement the steps of the above-mentioned electronic data forensics method.

[0046] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned electronic data forensics method. The computer-readable medium of the present invention may be included in the electronic device described in the above-mentioned embodiment; or it may exist independently without being assembled into the electronic device.

[0047] The computer-readable medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device implements the method in the above embodiment.

[0048] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0049] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0050] The above is only a specific implementation of the present invention, but the design concept of the present invention is not limited to this. Any non-substantial changes to the present invention using this concept shall be deemed as an infringement of the protection scope of the present invention.

Claims

1. A method for obtaining electronic data forensics, characterized in that: include Parse the image file through the file management system, obtain the metadata information of all files, build a file tree based on the metadata information and store it in the memory; Determine whether the file parsing module supports the data input into the memory; if so, search the metadata information of the target file to be parsed from the file tree, and obtain the target file from the image file for parsing according to the metadata information of the target file; if not, mount the file tree into a local directory through the application layer file system driver, and search the metadata information of the target file from the local directory; The file parsing module obtains the target file from the image file according to the metadata information of the target file and performs parsing.

2. The electronic data forensics method according to claim 1, characterized in that: The metadata information includes a data sector map, which represents the distribution of the file in the image file. The target file is obtained from the image file according to the data sector map in the metadata information of the target file.

3. The electronic data evidence collection method according to claim 2, characterized in that: The data sector map adopts a linked list, and each node of the linked list records the starting sector and the number of sectors of the file content; when obtaining the target file, reading starts from the starting sector of the node where the target file is located, combined with the number of sectors until the target file is read.

4. The electronic data forensics method according to claim 1, characterized in that: The metadata information includes parent directory information, and the file tree is constructed through the parent directory information; The metadata information of the target file to be parsed is searched according to the parent directory information of the file tree or the local directory.

5. The electronic data evidence collection method according to claim 1, characterized in that: The file management system also obtains the paths of all files in the image file; when the application layer file system driver mounts the file tree into a local directory, a mapping relationship between the complete path of the file and the metadata information and the path in the image file is established in the driver memory; by opening the complete path of the target file, the metadata information of the target file is obtained according to the mapping relationship.

6. The electronic data evidence collection method according to claim 5, characterized in that: The full path of the file includes the mounted local path and the path of the file in the image file.

7. An electronic data forensics system, characterized in that: include The file management system is used to parse the image files, obtain the metadata information of all files, build a file tree based on the metadata information and store it in the memory; A file parsing module searches for metadata information of a target file to be parsed from the file tree or searches for metadata information of a target file through the local directory, and obtains the target file from the image file for parsing according to the metadata information of the target file; The application layer file system driver is used to mount the file tree into a local directory when the file parsing module does not support input memory data.

8. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

Images