Portable evidence obtaining method and device, electronic equipment and storage medium

Abstract

The invention discloses a portable evidence obtaining method and device, electronic equipment and a storage medium, and the method is applied to movable edge computing equipment, and comprises the steps: obtaining self position data in real time through an integrated positioning module; associating the evidence obtaining terminal according to an association mode set before evidence obtaining, wherein different association modes require that the edge computing device and the evidence obtaining terminal have different relative mobility during signal transmission; receiving evidence content transmitted by the evidence obtaining terminal in a mobile evidence obtaining process in real time; binding the evidence content with current self position data and an association mode to serve as an association data packet; and performing uplink storage on the associated data packet as a block chain node. In this way, the method can adapt to evidence obtaining requirements of various different modes, an individual soldier can complete corresponding tasks, and the whole evidence obtaining efficiency and evidence obtaining rule reliability are improved.

Description

Technical Field

[0001] This application relates to the field of information storage technology, and in particular to a portable evidence collection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of computer technology, existing evidence comes in various forms and in large quantities. Investigators face challenges in collecting evidence on-site, including complex tasks and high requirements for efficiency and accuracy.

[0003] Before evidence collection, it is often impossible to accurately estimate the amount of evidence, and it is also unknown which pieces are important and which are secondary. Therefore, a significant amount of human and material resources are needed to quickly complete the evidence collection task. How to ensure the reliability of the evidence collection process while also maintaining efficiency is an urgent technical problem that needs to be solved. Summary of the Invention

[0004] This application provides a portable evidence collection method, apparatus, electronic device, and storage medium to address the technical problem of evidence collection efficiency.

[0005] According to one aspect of this application, a portable forensics method is provided, applied to a mobile edge computing device, comprising: It can acquire its own location data in real time by integrating a positioning module; The evidence collection terminal is associated with the association method set before evidence collection. Different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission. The evidence content transmitted by the evidence collection terminal during the mobile evidence collection process is received in real time. The evidence content is bound to the current location data and association method to form an associated data packet; As a blockchain node, the associated data packets are stored on the blockchain.

[0006] Furthermore, the step of associating the evidence-gathering terminal according to the association method set before evidence collection includes: In response to the evidence collection personnel logging in on the evidence collection terminal, the evidence collection terminal indicates the current association method; In response to the evidence collection terminal and the edge computing device being associated according to the indicated current association method, the evidence collection terminal enables the evidence collection function.

[0007] Furthermore, the associated evidence collection terminal includes: The first association method enables the evidence collection terminal and the edge computing device to transmit signals while maintaining their relative positions. The second association method does not restrict the relative positions of the evidence collection terminal and the edge computing device to remain unchanged during signal transmission.

[0008] Furthermore, the second connection method includes at least one of USB cable connection, HDMI cable connection, WIFI connection, and Bluetooth connection.

[0009] Furthermore, the evidence-gathering terminal indicates the current association method, including: Obtain the login account and login time of the evidence collection personnel, and obtain the current association method based on the pre-set mapping relationship between the login account, login time and association method.

[0010] Furthermore, the method also includes: The evidence collection task is assigned for the first time to collect evidence and obtain several related data packets; The importance of the content in the associated data packets is identified to obtain associated data packets with an importance higher than the preset value, which are then used as secondary evidence collection tasks. Identify the association method in the process of generating the associated data packets corresponding to the secondary forensics task; For secondary forensics tasks where the association method does not match the importance level, secondary forensics is performed, wherein the security level of the association method during secondary forensics is higher than that of the primary forensics. The associated data packets obtained from the secondary forensics are stored on the blockchain and associated with the corresponding data packets obtained from the primary forensics.

[0011] Furthermore, the security level of the association method used in the secondary forensics process is higher than that of the primary forensics process, including: The security level of the first association method is higher than that of the second association method, and among the second association methods, the security level of the wired method is higher than that of the wireless method.

[0012] A second aspect of this application provides a portable forensics device for use in a mobile edge computing device, comprising: The self-location data acquisition module is used to acquire its own location data in real time through the integrated positioning module; The association module is used to associate the evidence collection terminal according to the association method set before evidence collection. Different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission. The evidence receiving module is used to receive evidence content transmitted by the evidence collection terminal in real time during the mobile evidence collection process; The binding module is used to bind the evidence content with its current location data and association method as an associated data packet. The storage module is used as a blockchain node to store the associated data packets on the blockchain.

[0013] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method described in the first aspect of this application.

[0014] A fourth aspect of this application provides a computer-readable storage medium for storing a computer program that, when run on a computer, causes the computer to perform the method described in the first aspect of this application.

[0015] Beneficial effects In this embodiment of the application, a portable forensics method is employed and applied to a mobile edge computing device, comprising: The edge computing device acquires its own location data in real time through an integrated positioning module; it associates the evidence collection terminal with the association method set before evidence collection, and different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission; it receives the evidence content transmitted by the evidence collection terminal during mobile evidence collection in real time; it binds the evidence content with its current location data and association method as an association data packet; and it stores the association data packet on the blockchain as a blockchain node.

[0016] The above methods utilize mobile edge computing devices and evidence collection terminals to achieve high real-time evidence retrieval and storage; they also provide multiple association methods to adapt to various evidence collection needs; the small and portable nature of the devices allows a single person to complete the corresponding task; and one edge computing device can work with multiple evidence collection terminals simultaneously, thus greatly improving device utilization; by storing real-time evidence content on the blockchain in association data packets bound to the edge device's location and association method, the importance of relevant evidence can be identified on the blockchain through association data packets to guide secondary evidence collection, thereby improving the overall efficiency and reliability of evidence collection. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of a portable forensics method according to an embodiment of this application.

[0018] Figure 2 This is a schematic diagram of a portable evidence collection device according to an embodiment of this application.

[0019] Figure 3 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0022] This embodiment provides an evidence collection system, which includes a portable edge computing device and an evidence collection terminal. The evidence collection terminal provides an interface for evidence collectors, including functions such as login, shooting, and marking. The edge computing device provides functions such as evidence packaging and storage, and power supply. The edge computing device can transmit data with the evidence collection terminal in various ways, such as wireless and wired methods. The wired method includes establishing a stable connection between the edge computing device and the evidence collection terminal, making them an integrated structure without relative movement. For example, the edge computing device can be fixed to the evidence collection terminal by setting clips, or a structure connected by a data cable. This structure allows for a certain degree of relative movement between the edge computing device and the evidence collection terminal within the allowable range of the data cable length.

[0023] The different data transmission methods mentioned above make it possible for one edge computing device to connect to multiple evidence collection terminals simultaneously. In particular, the wireless connection method has fewer restrictions on the relative position between the edge computing device and the evidence collection terminal, and can support multiple evidence collection terminals to collect evidence at the same time within a certain range, which greatly improves the efficiency of evidence collection.

[0024] In order to solidify evidence in a timely manner at the scene of evidence collection, the edge computing device is set up as a blockchain node, which can package the data and store it on the chain to achieve data trustworthiness and traceability.

[0025] The aforementioned forensic system is particularly suitable for locations with ample forensic space and large-scale forensic tasks. For such needs, multiple edge computing devices and forensic terminals are typically prepared, with multiple personnel working simultaneously to complete the forensic work as quickly as possible. The specific forensic methods employed in implementing the aforementioned system are as follows: Step 1: Power on the evidence collection terminal and edge computing device and complete initialization. The evidence collection terminal and edge computing device are paired. Pairing here refers to the evidence collection terminal and edge computing device working together. Pairing can be achieved wirelessly, such as through Bluetooth, or it can be confirmed by manual designation. At this time, the method of transmitting evidence data between the two has not yet been determined.

[0026] Step 2: The evidence collection personnel log in to the evidence collection terminal, and the evidence collection terminal provides the connection method between the evidence collection terminal and the paired edge computing device, and prompts the evidence collection personnel to complete the connection according to the operation instructions. At this time, the evidence data transmission channel between the edge computing device and the evidence collection terminal is established.

[0027] Step 3: The evidence collector uses a handheld evidence collection terminal to collect evidence. At this time, the edge computing device may or may not be held by the evidence collector, depending on the connection method. During the evidence collection process, the edge computing device records its own location data in real time through its own positioning module. As the evidence collection process progresses, the evidence content is transmitted to the edge computing device through the data transmission channel. The evidence content usually includes the data such as pictures and videos of the evidence itself, as well as the location, timestamp, and other information of the handheld terminal at the time of evidence collection. After the relevant data is packaged inside the edge computing device, it is stored on the blockchain to complete the solidification of the evidence.

[0028] Step 4: With the completion of the first round of evidence collection, the on-chain smart contract identifies and associates the evidence uploaded to the chain, marks the importance of each piece of evidence, and sends a list of evidence collected at least including the evidence and its importance, the evidence collection terminal, and the edge computing device information to each evidence collection terminal.

[0029] Step 5: Based on the evidence list from the first evidence collection, verify the degree of matching between the importance and the security of the data transmission method used during the first evidence collection. For evidence with high importance but low security, conduct a second evidence collection.

[0030] During secondary evidence collection, relevant evidence is located based on the location, images, and other information of the evidence in the evidence list. Edge computing devices and handheld terminals with matching data transmission channel security are selected to conduct secondary evidence collection on this evidence and store it on the blockchain.

[0031] Applying the above method to one side of the edge computing device, such as Figure 1 The diagram shown is a flowchart of a portable forensics method according to an embodiment of this application. The method includes: Step S101: Obtain your own location data in real time through the integrated positioning module. Positioning modules include various methods, including but not limited to GPS, BeiDou, and UWB, which can be selected as needed. For example, GPS or BeiDou is suitable for outdoor use, while UWB is suitable for indoor use. Edge computing devices are an essential link in evidence transmission; therefore, recording their location from an evidence compliance perspective is necessary. Furthermore, the location changes of edge computing devices during the evidence collection process are related to their corresponding data transmission methods. For example, when the two are relatively fixed, the location changes of the edge computing device remain consistent with the fixed terminal device. Or, for example, when a terminal device is connected to an edge computing device via Bluetooth, that device can support edge computing devices within the Bluetooth radius. However, as the evidence collection progresses, if the Bluetooth signal of some devices becomes weak, the relative positional relationship between the edge computing device and each associated evidence collection terminal should be checked promptly. The edge computing device should be adjusted to once again support the original multiple evidence collection terminals. If this is not possible, some devices should be switched to connect with other edge computing devices in a timely manner.

[0032] Step S102: Associate the evidence collection terminal according to the association method set before evidence collection. Different association methods require different relative mobility between the edge computing device and the evidence collection terminal during signal transmission. Typically, higher-level evidence collection workers are associated with a more secure association method, while lower-level evidence collection workers are associated with a less secure association method. That is, one edge computing device can support multiple lower-level evidence collection workers to collect evidence simultaneously to achieve higher evidence collection efficiency, and one edge computing device can support one higher-level evidence collection worker to achieve better evidence collection results. On-site, the number of edge devices, terminal devices, and personnel can be appropriately combined according to the above strategy to balance evidence collection speed and effectiveness.

[0033] Step S103: Receive the evidence content transmitted by the evidence collection terminal during the mobile evidence collection process in real time. For example, when collecting evidence by taking a photo, the evidence collection terminal turns on the camera to take a picture, performs preliminary edge cropping, marks the time of shooting, and marks the location of the photo as evidence content, and transmits it to the corresponding edge computing device.

[0034] Step S104: Bind the evidence content with the current location data and association method as an associated data packet.

[0035] Step S105: The edge computing device has a large-capacity storage device, which acts as a blockchain node to store the associated data packets on the blockchain.

[0036] The above methods utilize mobile edge computing devices and evidence collection terminals to achieve high real-time evidence retrieval and storage; they also provide multiple association methods to adapt to various evidence collection needs; the small and portable nature of the devices allows a single person to complete the corresponding task; and one edge computing device can work with multiple evidence collection terminals simultaneously, thus greatly improving device utilization; by storing real-time evidence content on the blockchain in association data packets bound to the edge device's location and association method, the importance of relevant evidence can be identified on the blockchain through association data packets to guide secondary evidence collection, thereby improving the overall efficiency and reliability of evidence collection.

[0037] In some preferred embodiments, in order to associate the evidence-gathering terminal according to the association method set before evidence gathering, the following steps are included: In response to the evidence collection personnel logging in on the evidence collection terminal, the evidence collection terminal indicates the current association method; In response to the evidence collection terminal and the edge computing device being associated according to the indicated current association method, the evidence collection terminal enables the evidence collection function.

[0038] For example, when a high-level forensics personnel logs in, the automatic push notification uses a higher-security method. When a low-level forensics personnel logs in, the push notification can use an appropriate-security-level method.

[0039] In some preferred embodiments, to maximize the use of the same edge computing device to adapt to more forensic terminals, the forensic terminal indicates the current association method, including: The system obtains the login account and login time of the forensic personnel, and determines the current association method based on a pre-defined mapping relationship between the login account, login time, and association method. For example, forensic personnel of the same lower level, when they are assigned forensic tasks at the forensic site, their corresponding forensic devices are pre-paired with the same edge computing device. They then log in to their respective forensic devices at similar login times. The pre-defined mapping relationship assigns these forensic devices to association methods with lower security levels and makes full use of the connection channels of the edge computing device as much as possible.

[0040] In some preferred embodiments, the associated forensic terminal includes: The first association method allows the evidence collection terminal and the edge computing device to transmit signals while maintaining their relative positions. For example, the edge computing device is equipped with a connector plug, and data transmission is achieved by inserting the plug into the corresponding socket of the evidence collection terminal. The connector plug can be a USB interface, HDMI interface, PLCe interface, etc. Furthermore, the edge computing device has a snap-fit ​​design that allows the evidence collection terminal and the edge computing device to be bound together as one unit.

[0041] The second association method does not restrict the relative position between the evidence collection terminal and the edge computing device to remain unchanged during signal transmission. The second association method includes at least one of USB cable connection, HDMI cable connection, WIFI connection, and Bluetooth connection.

[0042] In some preferred embodiments, to ensure that the collection of certain important evidence is more accurate and standardized, the method further includes: The evidence collection task is assigned for the first time to collect evidence and obtain several related data packets; The importance of the content in the associated data packets is identified to obtain associated data packets with an importance higher than the preset value, which are then used as secondary evidence collection tasks. Identify the association method in the process of generating the associated data packets corresponding to the secondary forensics task; For secondary forensics tasks where the association method does not match the importance level, secondary forensics is performed, wherein the security level of the association method during secondary forensics is higher than that of the primary forensics. The associated data packets obtained from the secondary forensics are stored on the blockchain and associated with the corresponding data packets obtained from the primary forensics.

[0043] In some preferred embodiments, the security level of the association method during secondary forensics is higher than that of the primary forensics method, including: the security level of the first association method is higher than that of the second association method, and the security level of the wired method in the second association method is higher than that of the wireless method.

[0044] Using the above method, if important evidence was initially collected by lower-level personnel, a second collection will be conducted; if it was initially collected by higher-level personnel, a second collection is not necessary. Thus, in some embodiments, the data packets from the two collections can be compared to assess the standardization of the lower-level personnel's evidence collection process, which can then be used as a reference for their performance evaluation and promotion.

[0045] Based on the same inventive concept as the above-described method embodiments, this application also provides a portable forensics device applied to a mobile edge computing device, comprising: The self-location data acquisition module is used to acquire its own location data in real time through the integrated positioning module; The association module is used to associate the evidence collection terminal according to the association method set before evidence collection. Different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission. The evidence receiving module is used to receive evidence content transmitted by the evidence collection terminal in real time during the mobile evidence collection process; The binding module is used to bind the evidence content with its current location data and association method as an associated data packet. The storage module is used as a blockchain node to store the associated data packets on the blockchain.

[0046] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Based on the same inventive concept as the above method embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it enables the electronic device to implement the control method described in the above embodiments.

[0047] In one embodiment, the electronic device may be a server, and in this embodiment, the structure of the electronic device may be as follows: Figure 3 As shown, it includes a memory 2001, a communication module 2003, and one or more processors 2002.

[0048] The memory 2001 is used to store computer programs executed by the processor 2002. The memory 2001 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0049] Memory 2001 may be volatile memory, such as random-access memory (RAM); memory 2001 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 2001 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 2001 may be a combination of the above-mentioned memories.

[0050] Processor 2002 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 2002 is used to implement the above-mentioned audio data processing method when calling computer programs stored in memory 2001.

[0051] The communication module 2003 is used to communicate with terminal devices and other servers.

[0052] This application embodiment does not limit the specific connection medium between the memory 2001, communication module 2003, and processor 2002. This application embodiment... Figure 3 The memory 2001 and the processor 2002 are connected via a bus 2004, which is in... Figure 3 The connections between other components are illustrated with arrows and are for illustrative purposes only, not as limiting information. The Bus 2004 can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 3 The text uses only one arrow to describe it, but does not indicate that there is only one bus or one type of bus.

[0053] Based on the same inventive concept as the above-described method embodiments, embodiments of the present invention also provide a computer-readable storage medium for storing a computer program. When the computer program is run on a computer, it enables the electronic device to implement the control method described in the above embodiments. The computer-readable storage medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0054] Based on the same inventive concept as the above-described method embodiments, embodiments of the present invention also provide a computer program product, which includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of the control methods described above according to various exemplary embodiments of this application. The program product may take the form of any combination of one or more readable media. These computer program commands can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the commands executed by the processor of the computer or other programmable data processing device generate a process for implementing... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0055] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

Claims

1. A portable forensics method, applied to a mobile edge computing device, characterized in that, include: It can acquire its own location data in real time by integrating a positioning module; The evidence collection terminal is associated with the association method set before evidence collection. Different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission. The evidence content transmitted by the evidence collection terminal during the mobile evidence collection process is received in real time. The evidence content is bound to the current location data and association method to form an associated data packet; As a blockchain node, the associated data packets are stored on the blockchain.

2. The method according to claim 1, characterized in that, The process of associating the evidence-gathering terminal according to the association method set before evidence gathering includes: In response to the evidence collection personnel logging in on the evidence collection terminal, the evidence collection terminal indicates the current association method; In response to the evidence collection terminal and the edge computing device being associated according to the indicated current association method, the evidence collection terminal enables the evidence collection function.

3. The method according to claim 2, characterized in that, The associated evidence collection terminal includes: The first association method enables the evidence collection terminal and the edge computing device to transmit signals while maintaining their relative positions. The second association method does not restrict the relative positions of the evidence collection terminal and the edge computing device to remain unchanged during signal transmission.

4. The method according to claim 3, characterized in that, The second connection method includes at least one of USB cable connection, HDMI cable connection, WIFI connection, and Bluetooth connection.

5. The method according to claim 3, characterized in that, The evidence collection terminal indicates the current association method, including: Obtain the login account and login time of the evidence collection personnel, and obtain the current association method based on the pre-set mapping relationship between the login account, login time and association method.

6. The method according to any one of claims 2-5, characterized in that, The method further includes: The evidence collection task is assigned for the first time to collect evidence and obtain several related data packets; The importance of the content in the associated data packets is identified to obtain associated data packets with an importance higher than the preset value, which are then used as secondary evidence collection tasks. Identify the association method in the process of generating the associated data packets corresponding to the secondary forensics task; For secondary forensics tasks where the association method does not match the importance level, secondary forensics is performed, wherein the security level of the association method during secondary forensics is higher than that of the primary forensics. The associated data packets obtained from the secondary forensics are stored on the blockchain and associated with the corresponding data packets obtained from the primary forensics.

7. The method according to claim 6, characterized in that, The security level of the association method used in the secondary evidence collection process is higher than that of the primary evidence collection process, including: The security level of the first association method is higher than that of the second association method, and among the second association methods, the security level of the wired method is higher than that of the wireless method.

8. A portable evidence collection device, applied to a mobile edge computing device, characterized in that, include: The self-location data acquisition module is used to acquire its own location data in real time through the integrated positioning module; The association module is used to associate the evidence collection terminal according to the association method set before evidence collection. Different association methods require the edge computing device and the evidence collection terminal to have different relative mobility during signal transmission. The evidence receiving module is used to receive evidence content transmitted by the evidence collection terminal in real time during the mobile evidence collection process; The binding module is used to bind the evidence content with its current location data and association method as an associated data packet. The storage module is used as a blockchain node to store the associated data packets on the blockchain.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it causes the electronic device to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1 to 7.

Images