Instant conference evidence obtaining method and device based on memory reverse analysis

Abstract

The invention provides an instant conference evidence obtaining method and device based on memory reverse analysis. The method comprises the following steps: acquiring a target memory image; analyzing the target memory image by using a preset conference metadata reverse extraction algorithm to obtain conference metadata; the conference metadata reverse extraction algorithm comprises the following steps: identifying process information of an instant conference in a memory image, extracting and dumping files related to the process information in a memory, and analyzing the dumped memory files to extract conference metadata; scanning and matching the memory image by using a preset conference data stream engraving algorithm to obtain conference data stream information; the conference data flow library adjusting algorithm comprises the steps of reconstructing a data structure of a text message and / or a file message transmitted in an instant conference, identifying and positioning a key data structure needing evidence obtaining in the memory mapping according to the reconstructed data structure, and extracting conference data flow information from the positioned key data structure.

Description

Technical Field

[0001] The present invention relates to the technical field of digital forensics, and in particular, to an instant meeting forensics method and device based on memory reverse analysis. Background Art

[0002] With the rapid advancement of the digital age, instant meeting software such as Tencent Meeting, DingTalk, Google Meet, and Zoom has become an indispensable tool in the fields of business communication, remote collaboration, online education, and telecommuting. However, due to the popularity of instant meeting software applications, it is vulnerable to various network attacks, such as meeting bombing, spreading malicious links or virus-containing files in chats, stealing meeting links and permissions, etc. Some scholars believe that the relevant data during the operation of instant meeting software is the key to solving digital crime cases such as related legal proceedings and commercial disputes. Therefore, the technology for extracting evidence related to instant meeting software is one of the important research directions in the current digital forensics field.

[0003] Although traditional disk forensics methods can provide certain data recovery capabilities, their limitations are gradually emerging for the dynamic data generated by instant meeting software. Through disk forensics, forensic personnel can only obtain the files downloaded and saved during the meeting. For trace information such as meeting records of instant meeting software, due to the instantaneity and encryption of data transmission, it cannot be forensically obtained through the disk. And the operation of any process always passes through memory. Therefore, evidence information such as meeting records will always leave traces in memory, which requires forensic personnel to turn their research direction to more dynamic memory forensics technology. Therefore, memory forensics, as a technical means, its application in instant meeting software forensics becomes particularly important. Summary of the Invention

[0004] To solve the memory forensics problem in instant meeting software, the present invention provides an instant meeting forensics method and device based on memory reverse analysis.

[0005] In a first aspect, the present invention provides an instant meeting forensics method based on memory reverse analysis, including:

[0006] Obtain a target memory image;

[0007] Analyze the target memory image by using a preset meeting metadata reverse extraction algorithm to obtain meeting metadata; the meeting metadata reverse extraction algorithm includes identifying the process information of the instant meeting in the memory image, extracting the files related to the process information in the memory and dumping them, and analyzing the dumped memory files to extract the meeting metadata;

[0008] Use a preset conference data stream carving algorithm to scan and match the memory image to obtain conference data stream information; the conference data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant conference, identifying and locating key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting conference data stream information from the located key data structures.

[0009] Further, identify the process information of an instant conference in the memory image, specifically including: using a memory forensics tool to retrieve and list all process lists related to the instant conference in the target memory image, and analyzing all process lists to extract the process numbers.

[0010] Further, extract and dump the files related to the process information in the memory, specifically including: using the process number as the query content, and using a memory forensics tool to screen and dump the files associated with the process number in the memory.

[0011] Further, analyze the dumped memory files to extract the conference metadata, specifically including: determining the file types storing the conference metadata according to prior knowledge, screening out all files belonging to the file types from the memory files, and analyzing each of the screened files one by one to extract at least one piece of conference metadata such as the creation time, conference theme, and conference number of the instant conference.

[0012] Further, reconstruct the data structures of text messages and / or file messages transmitted in an instant conference, specifically including: simulating the process of sending text messages and / or file messages in an instant conference, and obtaining the memory image file corresponding to the simulation process; using a data recovery tool to search for the sent text messages and / or file messages in the memory image file corresponding to the simulation process to determine the data structures where the text messages and / or file messages are located.

[0013] Further, identify and locate the key data structures to be forensically investigated in the memory image according to the reconstructed data structures, specifically including: searching for all strings belonging to the reconstructed data structures in the memory image, and screening out the key data structures to be forensically investigated from the found strings using preset verification data; where the verification data refers to fixed strings adjacent to the storage locations of text messages and / or file messages transmitted in the instant conference.

[0014] Further, extract the conference data stream information from the located key data structure, specifically including: extracting the message objects in the data block where the key identifiers are located, and the key identifiers include timestamp, user ID, conference identifier, user identifier, message content, transmitted file name, file storage path, file type, and file size; integrating all the extracted message objects in the order of the timestamps to form a conference process and constituting a data stream, and marking key events in the data stream.

[0015] In a second aspect, the present invention provides an instant conference forensics device based on memory reverse analysis, including:

[0016] An acquisition module, configured to acquire a target memory image;

[0017] A metadata extraction module, configured to analyze the target memory image by using a preset conference metadata reverse extraction algorithm to obtain conference metadata; the conference metadata reverse extraction algorithm includes identifying the process information of an instant conference in the memory image, extracting the files related to the process information in the memory and performing dumping, and analyzing the dumped memory files to extract conference metadata;

[0018] A data stream carving module, configured to scan and match the memory image by using a preset conference data stream carving algorithm to obtain conference data stream information; the conference data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant conference, identifying and locating the key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting conference data stream information from the located key data structures.

[0019] In a third aspect, the present invention provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the processor executes the program, the method described in the first aspect is implemented.

[0020] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0021] The beneficial effects of the present invention are as follows:

[0022] Aiming at the problem of extracting evidence of the running behavior of instant conference software in memory, the method and device of the present invention can recover the complete information of instant conferences and user behavior data, providing evidence for digital crime forensics. Description of the Drawings

[0023] Figure 1Schematic flowchart of the instant meeting forensics method based on memory reverse analysis provided by an embodiment of the present invention;

[0024] Figure 2 Forensics framework when the method of the present invention is applied to Tencent Meeting provided by an embodiment of the present invention;

[0025] Figure 3 Schematic flowchart of the Tencent Meeting metadata extraction algorithm provided by an embodiment of the present invention;

[0026] Figure 4 One of the schematic diagrams of system process extraction provided by an embodiment of the present invention;

[0027] Figure 5 Another schematic diagram of system process extraction provided by an embodiment of the present invention;

[0028] Figure 6 Information extracted from the memory dump file provided by an embodiment of the present invention;

[0029] Figure 7 Search results of the "howareyou" message provided by an embodiment of the present invention;

[0030] Figure 8 Text data structure provided by an embodiment of the present invention;

[0031] Figure 9 Search results of the "storyforus" message provided by an embodiment of the present invention;

[0032] Figure 10 File data structure provided by an embodiment of the present invention;

[0033] Figure 11 Text information storage structure provided by an embodiment of the present invention;

[0034] Figure 12 File information storage structure provided by an embodiment of the present invention;

[0035] Figure 13 Comparison of recognition results corresponding to the use of the pslist / psscan plug-in provided by an embodiment of the present invention;

[0036] Figure 14 Schematic structural diagram of the instant meeting forensics device based on memory reverse analysis provided by an embodiment of the present invention;

[0037] Figure 15 Block diagram of the structure of an electronic device provided by an embodiment of the present invention. Detailed implementation manners

[0038] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0039] An embodiment of the present invention provides an instant meeting forensics method based on memory reverse analysis, as Figure 1 shown, which includes the following steps:

[0040] S101: Obtain a target memory image;

[0041] S102: Analyze the target memory image by using a preset conference metadata reverse extraction algorithm to obtain conference metadata; the conference metadata reverse extraction algorithm includes identifying the process information of an instant meeting in the memory image, extracting and dumping the files related to the process information in the memory, and analyzing the dumped memory files to extract the conference metadata;

[0042] S103: Scan and match the memory image by using a preset conference data stream carving algorithm to obtain conference data stream information; the conference data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant meeting, identifying and locating the key data structures to be forensically analyzed in the memory image according to the reconstructed data structures, and extracting the conference data stream information from the located key data structures.

[0043] The instant meeting forensics method based on memory reverse analysis provided by the embodiment of the present invention can recover the complete information of an instant meeting and user behavior data, providing evidence for digital crime forensics.

[0044] As an instant meeting software, Tencent Meeting is widely and actively used. During the operation of Tencent Meeting, important evidence of user behavior will be left in the memory. Therefore, on the basis of the above embodiments, aiming at the problem of extracting the evidence of the operation behavior of the Tencent Meeting software in the memory, the embodiment of the present invention conducts in-depth memory forensics analysis on Tencent Meeting as the object, and is expected to extract relevant evidence generated during the operation of Tencent Meeting through memory forensics technology. The method framework is as Figure 2As shown in the figure, first, obtain the memory image running the Tencent Meeting software; then analyze it from two aspects. On the one hand, design an algorithm for reverse extraction of Tencent Meeting metadata to analyze the memory image and extract metadata information such as the meeting theme and meeting number of Tencent Meeting. On the other hand, design an algorithm for carving Tencent Meeting data streams to analyze the memory image and extract the data stream information generated during the participation in Tencent Meeting. The meeting data stream information includes social evidence such as participants, user identifiers, timestamps, etc., which is of great value for forensic investigation, as well as behavioral evidence such as message records and files sent by users during the operation of Tencent Meeting.

[0045] For Tencent Meeting, as Figure 3 shown, the algorithm for reverse extraction of Tencent Meeting metadata mainly includes three steps: identification of Tencent Meeting processes, extraction of Tencent Meeting process memory, and extraction of Tencent Meeting metadata. In one embodiment, the identification of Tencent Meeting processes specifically includes: using a memory forensic tool to retrieve and list all process lists related to Tencent Meeting in the target memory image, and analyzing all process lists to extract the process number. The extraction of Tencent Meeting process memory specifically includes: using the process number as the query content, and using a memory forensic tool to screen and dump the files associated with the process number in the memory. The extraction of Tencent Meeting metadata specifically includes: determining the file type storing the meeting metadata according to prior knowledge, screening out all files belonging to the file type from the memory files, and analyzing each of the screened files one by one to extract at least one piece of meeting metadata such as the creation time, meeting theme, and meeting number of the instant meeting.

[0046] As an example, in practical applications, the detailed process of the algorithm for reverse extraction of Tencent Meeting metadata designed in this embodiment is as follows:

[0047] ① Use VMware to create a Win10 virtual machine, create a Tencent Meeting with the theme of "Memory Forensic", and obtain the meeting number 788357045.

[0048] ② Capture the memory image file "Windows 10x64 - da1a05fb.vmem" through the virtual machine during the meeting.

[0049] ③ Use Volatility to analyze the memory image file, and list the process lists related to Tencent Meeting through the pslist or psscan plugin. Volatility is a memory forensic framework, and its main functions include process and thread analysis, file and module analysis, network connection analysis, user and credential extraction, kernel and system information analysis, and malware analysis. The pslist or psscan plugin is two plugins in Volatility, mainly used for process and thread analysis.

[0050] ④Extract the process ID (PID) and its virtual address number corresponding to the Tencent Meeting process, such as Figure 4 shown. As can be seen from the figure, in the task manager built into the computer, Tencent Meeting exists and runs in memory with the process name "wemeetapp.exe".

[0051] ⑤Use the dumpfiles command of Volatility to dump the files in memory with the help of the PID number, and then transfer them through the pipeline to the findstr command to filter the memory files related to Tencent Meeting, such as Figure 5 shown.

[0052] ⑥Analyze the content of the dumped memory files. It can be found that there are various types of files in the dumped files, including data files (dat), virtual address control block files (vacb), and disk image files (img). Open and analyze the dumped files one by one, and finally find the creation time, theme, and meeting number of the Tencent Meeting in the dat file. The content is as Figure 6 shown, which is consistent with the actual creation of the meeting, proving that the required Tencent Meeting metadata information is stored in the dat-type dumped file.

[0053] In the embodiment of the present invention, by simulating the process of initiating Tencent Meeting, the file types for storing Tencent Meeting metadata are summarized, and this is used as prior knowledge. Furthermore, an algorithm for reverse extraction of Tencent Meeting metadata is proposed. Based on the memory files dumped by Volatility, the dat-type files in the dumped folder are scanned, and they are converted into strings in the format of Figure 6 "2024-04-24 08:43:31MemoryForensic 788357045" in

[0054] The meeting data stream of Tencent Meeting generally refers to various data and information flows generated, transmitted, and stored during the meeting, including the basic information of participating users, text and file messages sent, and sending times. There has been a certain amount of research on memory forensics and memory structure analysis in previous studies. For meeting data stream information such as meeting records, the embodiment of the present invention proposes a meeting data stream carving algorithm to obtain Tencent Meeting data stream information. This algorithm mainly includes three steps: reverse reconstruction of the Tencent Meeting data structure, matching of the meeting data stream, and extraction of the meeting data stream.

[0055] In one embodiment, the reverse reconstruction of the Tencent Meeting data structure specifically includes: simulating the process of sending text messages and / or file messages in an instant meeting, and obtaining the memory image file corresponding to the simulation process; using a data recovery tool to search for the sent text messages and / or file messages in the memory image file corresponding to the simulation process to determine the data structure where the text messages and / or file messages are located. The matching of the meeting data stream specifically includes: finding all strings belonging to the reconstructed data structure in the memory image, and filtering out the key data structures to be forensically investigated from all the found strings using preset verification data; wherein the verification data refers to fixed strings adjacent to the storage locations of the text messages and / or file messages transmitted in the instant meeting. The extraction of the meeting data stream specifically includes extracting the message objects in the data block where the key identifiers are located, and the key identifiers include timestamp, user ID, meeting ID, user identification, message content, transmitted file name, file storage path, file type, and file size; integrating all the extracted message objects in the order of the timestamps to form a meeting process and composing a data stream, and marking the key events in the data stream.

[0056] As an example, in practical applications, the detailed process of the Tencent Meeting data stream carving algorithm designed in this embodiment is as follows:

[0057] (1) Reverse reconstruction of the Tencent Meeting data structure

[0058] The main purpose of the reverse reconstruction of the Tencent Meeting data structure is to construct the structural information of the various data of the Tencent Meeting stored in the memory. The basic design idea is as follows:

[0059] ① Use VMware to create a Win10 virtual machine, create and participate in a Tencent Meeting, and send text messages such as "how are you" and file messages such as "story for us.mp3".

[0060] ② Capture the memory image file "Windows 10x64-da1a05fb.vmem" through the virtual machine.

[0061] ③ Use the WinHex tool to open the obtained memory image file "Windows 10x64-da1a05fb.vmem" and perform reverse analysis of the data structure for text and file messages. The WinHex tool is a data recovery tool widely used in data recovery, digital forensics, file editing and other fields.

[0062] ④ Reverse reconstruction of the text message structure: Search for the sent text message "how are you", and the search results are as Figure 7As shown. It can be seen from the figure that "how are you" and "text_elem_content" together form a key-value pair, that is, "how are you" is stored in "text_elem_content". Taking the key-value pair "text_elem_content": "how are you" as the center, analyzing forward from the figure, it can be seen that there is also a set of key-value pairs "elem_type": 0 before this key-value pair. After verification by multiple sets of data, although it has no evidentiary significance, it exists in the same object as the verification data and the message key-value pair. Continuing to analyze forward, the "{" and "[" can be seen in the figure, proving that some data may exist in the same object or the same array. Continuing to analyze backward, the "}" can be found, indicating that the above two sets of key-value pairs exist in the same object. There are also multiple sets of objects after it, and multiple key-value pairs associated with the message such as "nickname": "ysl", "unique_id": "144115391065829678", etc. can be found, which are consistent with the actual situation. Finally, the "]" is found, proving that multiple sets of objects are stored in the array "message_elem_array" together, that is, it is represented as stored in the same "[]" in the figure. Therefore, this array as a whole represents all the relevant information of this message, and the validity of this part of the data can also be determined according to its integrity. When searching for "how are you", multiple search results will appear. Just analyze whether it has verification data to determine whether it is a valid search result. Therefore, the final result can be determined through screening.

[0063] Through the analysis of Figure 7 the overall data, it can be known that most of the objects exist as necessary components in an array, having no evidentiary significance and only being used for verification. Therefore, analyzing other information from the perspective of evidence collection, the meaningful text data structure of Tencent Meeting in memory is as Figure 8 .

[0064] ⑤ Reverse reconstruction of the file message structure: Search for the sent MP3 file "story for us" in the memory image file "Windows 10x64-da1a05fb.vmem". The search results are as Figure 9As shown. It can be seen from the figure that the file name "story forus" and "name" together form a key-value pair, and are stored in the object "file_info" together with multiple other groups of key-value pairs. Analyzing the surrounding data centered on this key-value pair, it can be seen that there are multiple groups of key-value pairs associated with this file: "nickname":"ysl", "size":5368895, "report_file_type":"mp3", etc., which are consistent with the actual situation. Analyzing the data forward, it can be seen that multiple objects are also stored in the array "message_elem_array". Therefore, as a whole, this array represents all the relevant information of this file, which is the same as the text. Analyzing backward can also find the end position of the array, forming a closed loop. According to the integrity of this array, the validity of this part of the data can also be determined to prevent multiple invalid files from appearing during scanning.

[0065] By analyzing the overall data in the figure, it can be seen that most of the objects still only exist as necessary components in an array and have no evidentiary value, and can only be used for verification. Therefore, from the perspective of evidence collection, the finally obtained meaningful file data structure of Tencent Meeting in memory is as Figure 10 .

[0066] (2) Meeting data stream matching

[0067] The meeting data stream matching aims to accurately identify and locate the data structure of Tencent Meeting from the memory image file. To improve the search efficiency and reduce false matches, the embodiment of the present invention designs and adopts the Knuth-Morris-Pratt (KMP) algorithm and optimizes it to adapt to the characteristics of the Tencent Meeting data structure. The specific idea is as follows:

[0068] According to the reconstructed data structure, "message_elem_array" is a core data structure. Other key information such as message timestamps, user IDs, meeting identifiers, and message contents are all closely related to "message_elem_array" and are stored in this array. This inherent data correlation allows the algorithm to first locate "message_elem_array" to narrow the scope of subsequent searches, thereby improving the search efficiency.

[0069] After matching "message_elem_array", a second round of matching is performed, that is, matching the required key-value pairs according to the data structures of text messages and file messages in memory. Multiple "message_elem_array" will be matched in the first round of search. Therefore, in the second round, verification data such as the key-value pair "elem_type":0 needs to be used for screening to exclude invalid "message_elem_array" data.

[0070] Through a phased string matching strategy, this algorithm can effectively match the data structures required for Tencent Meeting forensics from the memory image file. This strategy improves the search efficiency and matching accuracy by reducing the search space and optimizing the search scope, and has important practical application value for data extraction in the memory forensics process.

[0071] (3) Meeting data stream extraction

[0072] The meeting data stream extraction stage aims to accurately extract specific meeting data stream information from the identified memory area. For this purpose, a carving algorithm is proposed as follows:

[0073] ① Determine the specific extraction range of each identifier by using the matching positions of the obtained message_elem_array and key-value pairs of other key data structures.

[0074] ② Based on the matching positions in the message_elem_array, extract the data blocks of the message element array, and extract the data blocks of identifiers such as message_client_time, nickname, unique_id, and text_elem_content respectively.

[0075] ③ Analyze the message_elem_array data block to identify the start and end positions of each message. Extract and parse the timestamp, the nicknames and unique identifiers of the sender and receiver, and the specific message content corresponding to each message.

[0076] ④ Build a complete message object containing message elements, timestamps, user information, and message content, and integrate all message objects in chronological order to form a meeting process as Figure 11 and Figure 12 .

[0077] ⑤ Organize the integrated meeting process into a data stream to ensure the logical order and integrity of the data, and mark key events in the data stream, such as meeting start, file transfer, important messages, etc.

[0078] ⑥ Organize the data into a formatted report output including key events and the complete meeting process.

[0079] Through the above steps, the meeting data stream carving algorithm can accurately extract and reconstruct meeting data, providing detailed evidence for further analysis and forensics.

[0080] To verify the performance of the instant meeting forensics method proposed in the present invention, the following test scenarios and test results are given.

[0081] 1. Test environment

[0082] Experimental environment: VMware Windows 10 virtual machine

[0083] Tools: Volatility, WinHex, Tencent Meeting client

[0084] 2. Performance analysis

[0085] Suppose Tencent Meeting is used to plan and implement a complex online case. In this case, the instant messaging function of Tencent Meeting is utilized to deceive victims into making investments through false identities and forged backgrounds. To cover up their criminal acts, the file transfer function of Tencent Meeting is also used to transmit forged investment reports and contract documents.

[0086] After the case is uncovered, the forensic investigators realize that the data stored in the memory of Tencent Meeting will be crucial evidence for revealing the criminal acts. Due to a large amount of communication and file transfer in Tencent Meeting, the memory may contain their real identity information, criminal plans, victims' personal information, and detailed records.

[0087] Therefore, forensic investigators need to conduct forensic analysis on the memory of Tencent Meeting to obtain this crucial evidence. This will help determine the real identities, expose their criminal acts, and protect more potential victims. Through the forensic analysis of the memory of Tencent Meeting, forensic investigators are expected to uncover the criminal network and take appropriate legal actions.

[0088] 3. Report parsing

[0089] When conducting forensic analysis on the memory image of Tencent Meeting, different conditions during the running and after the shutdown of Tencent Meeting need to be considered. In this experiment, the proposed reverse extraction algorithm for Tencent Meeting software metadata is used to identify and extract relevant information of the Tencent Meeting process "wemeetapp.exe" by using the pslist / pscan plugins of the Volatility tool.

[0090] When Tencent Meeting is running:

[0091] Using the pslist and pscan plugins of the Volatility tool respectively to identify and extract the Tencent Meeting process, it is found that there is no significant difference, as shown in the above text Figure 4 :

[0092] After Tencent Meeting is shut down:

[0093] Similarly, using the pslist / pscan plugins of the Volatility tool to identify and extract the Tencent Meeting process respectively, it is found that the output results for different commands are inconsistent. The comparison results are as Figure 13 shown.

[0094] After obtaining the process information, we dump the file using the process ID. We dump the Tencent Meeting dat file using the PID. We then extract the past meeting topics and records from the series of files output by the Tencent Meeting process using the specific format of metadata, and determine the start time of the most recent meeting, as shown in Table 1.

[0095] Table 1 Meeting topics and minutes

[0096] time meeting_code subject 2024-04-24 08.43.31 788 357 045 Memory Forensic - 307 853 721 Started by ysl - 652 279 045 Started by ysl - 734 820 003 Memory Forensic - 824 919 752 ***Scheduled Meeting - 558 310 859 ***Scheduled Meeting - 614 962 993 Memory Forensic

[0097] After obtaining the meeting number and topic, we need to obtain meeting data to provide strong evidence for digital crimes. Therefore, we use a meeting data stream carving algorithm to carve user behavior data. Previous research has established the data structure used by Tencent Meeting to store various information. After obtaining the data source file, we use the designed carving algorithm to scan, match, and extract the entire memory image file, outputting the user behavior data shown in Table 2.

[0098] Table 2 User conference data flow - message information

[0099] message_client_time main_meeting_id nickname unique_id text_elem_content 1713919468 4811776258022982393 ysl 144115391065829678 my friend 1713919508 4811776258022982393 Bob 144115392378737712 [Fireworks] 1713919480 4811776258022982393 ysl 144115391065829678 how are you? 1713919503 4811776258022982393 Bob 144115392378737712 It's ok 1713919462 4811776258022982393 ysl 144115391065829678 helllo

[0100] For file transfer, the experiment also uses the conference data stream carving algorithm to extract the user's file transfer behavior data. The results are shown in Table 3.

[0101] Table 3 User conference data flow - file information

[0102] nickname unique_id name report_file_type file_size ysl 144115391065829678 story for us.mp3 mp3 5M ysl 144115391065829678 test.txt txt 1K ysl 144115391065829678 analysis515.docx docx 1M

[0103] 4. Results Analysis

[0104] According to the output in Table 2, the same conference ID can confirm that the messages are from the same conference; even if each user has the same ID, they each have their own user ID, so they can still be distinguished; the timestamp indicates the time when the message was sent, and the conversion to Beijing time is consistent with the facts; the message content can provide important support for evidence acquisition.

[0105] Similarly, analysis of the output results in Table 3 confirms that the contents of the transmitted files are consistent with reality. The conference data stream carving algorithm was used to recover the information and transmitted files during the meeting. This played a key role in obtaining the true identity information, the victim's personal information, and detailed records, providing crucial evidence for criminal prosecution.

[0106] The above experiments demonstrate the feasibility and effectiveness of the instant conference forensics method based on memory reverse analysis proposed in this invention. It not only reproduces the data transmission of Tencent Conference, but also has important significance for the progress of forensics work on instant conferences.

[0107] Based on the same inventive concept, an embodiment of the present invention further provides an instant meeting forensics device based on memory reverse analysis, including an acquisition module, a metadata extraction module, and a data stream carving module.

[0108] The acquisition module is used to acquire a target memory image; the metadata extraction module is used to analyze the target memory image by using a preset meeting metadata reverse extraction algorithm to obtain meeting metadata; the meeting metadata reverse extraction algorithm includes identifying the process information of an instant meeting in the memory image, extracting files related to the process information in the memory and performing a dump, and analyzing the dumped memory files to extract meeting metadata; the data stream carving module is used to scan and match the memory image by using a preset meeting data stream carving algorithm to obtain meeting data stream information; the meeting data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant meeting, identifying and locating the key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting meeting data stream information from the located key data structures.

[0109] The instant meeting forensics device based on memory reverse analysis provided by the present invention is for implementing the above method, and its functions can be specifically referred to the above method embodiments and will not be elaborated here.

[0110] Figure 15 An entity structure diagram of an electronic device is exemplified, as Figure 15 shown. The electronic device may include: a processor 1501, a communication interface 1502, a memory 1503, and a communication bus 1504. Among them, the processor 1501, the communication interface 1502, and the memory 1503 communicate with each other through the communication bus 1504. The processor 1501 can call the logical instructions in the memory 1503 to execute an instant meeting forensics method based on memory reverse analysis. The method includes: acquiring a target memory image; analyzing the target memory image by using a preset meeting metadata reverse extraction algorithm to obtain meeting metadata; the meeting metadata reverse extraction algorithm includes identifying the process information of an instant meeting in the memory image, extracting files related to the process information in the memory and performing a dump, and analyzing the dumped memory files to extract meeting metadata; scanning and matching the memory image by using a preset meeting data stream carving algorithm to obtain meeting data stream information; the meeting data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant meeting, identifying and locating the key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting meeting data stream information from the located key data structures.

[0111] In addition, when the logic instructions in the above-mentioned memory 1503 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0112] The embodiments of the present invention further provide a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the instant meeting forensics method based on memory reverse analysis provided by the above-mentioned method embodiments.

[0113] The embodiments of the present invention further provide a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the instant meeting forensics method based on memory reverse analysis provided by the above-mentioned method embodiments.

[0114] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disks, optical discs, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An instant meeting forensics method based on memory reverse analysis, characterized in that, Including: Obtain a target memory image; Analyze the target memory image by using a preset conference metadata reverse extraction algorithm to obtain conference metadata; The conference metadata reverse extraction algorithm includes identifying process information of an instant conference in the memory image, extracting files related to the process information in the memory and dumping them, and analyzing the dumped memory files to extract conference metadata; Scan and match the memory image by using a preset conference data stream carving algorithm to obtain conference data stream information; the conference data stream library algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in the instant conference, identifying and locating key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting conference data stream information from the located key data structures.

2. The instant meeting forensics method based on memory reverse analysis according to claim 1, characterized in that, Identifying process information of an instant conference in the memory image specifically includes: using a memory forensics tool to retrieve and list all process lists related to the instant conference in the target memory image, and analyzing all process lists to extract process numbers.

3. The instant meeting forensics method based on memory reverse analysis according to claim 2, characterized in that, Extracting files related to the process information in the memory and dumping them specifically includes: using the process number as the query content, and using a memory forensics tool to screen out files associated with the process number in the memory and dump them.

4. The instant meeting forensics method based on memory reverse analysis according to claim 1, characterized in that Analyzing the dumped memory files to extract the conference metadata specifically includes: determining the file types storing the conference metadata according to prior knowledge, screening out all files belonging to the file types from the memory files, and analyzing each of the screened files one by one to extract at least one piece of conference metadata such as the creation time, conference theme, and conference number of the instant conference.

5. The instant meeting forensics method based on memory reverse analysis according to claim 1, wherein, Reconstructing the data structures of text messages and / or file messages transmitted in the instant conference specifically includes: simulating the process of sending text messages and / or file messages in the instant conference, and obtaining the memory image file corresponding to the simulation process; using a data recovery tool to search for the sent text messages and / or file messages in the memory image file corresponding to the simulation process to determine the data structures where the text messages and / or file messages are located.

6. The instant meeting forensics method based on memory reverse analysis according to claim 5, characterized in that, Identifying and locating key data structures to be forensically investigated in the memory image according to the reconstructed data structures specifically includes: searching for all strings belonging to the reconstructed data structures in the memory image, and screening out the key data structures to be forensically investigated from the found strings by using preset verification data; wherein, the verification data refers to fixed strings adjacent to the storage locations of text messages and / or file messages transmitted in the instant conference.

7. The instant meeting forensics method based on memory reverse analysis according to claim 1, wherein Extracting conference data stream information from the located key data structures specifically includes: extracting message objects in the data blocks where the key identifiers are located, the key identifiers including timestamps, user IDs, conference identifiers, user identities, message contents, transmitted file names, file storage paths, file types, and file sizes; integrating all the extracted message objects in the order of timestamps to form a conference process and compose a data stream, and marking key events in the data stream.

8. An instant meeting forensics device based on memory reverse analysis, characterized in that, Including: An acquisition module for acquiring a target memory image; A metadata extraction module, configured to analyze the target memory image by using a preset reverse extraction algorithm for conference metadata to obtain conference metadata; the reverse extraction algorithm for conference metadata includes identifying process information of an instant conference in the memory image, extracting files related to the process information in the memory and dumping them, and analyzing the dumped memory files to extract conference metadata; A data stream carving module, configured to scan and match the memory image by using a preset conference data stream carving algorithm to obtain conference data stream information; the conference data stream carving algorithm includes reconstructing the data structures of text messages and / or file messages transmitted in an instant conference, identifying and locating key data structures to be forensically investigated in the memory image according to the reconstructed data structures, and extracting conference data stream information from the located key data structures.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images