A method, apparatus, device and storage medium for electronic data forensics

Abstract

This invention proposes a method, apparatus, device, and storage medium for electronic data forensics, relating to the field of electronic data forensics technology. The method includes: converting acquired multi-source electronic data into standardized text; dividing the standardized text into text blocks and storing them in a knowledge base, and constructing a relationship graph based on the text blocks; parsing the acquired electronic data forensics request to generate a structured search instruction, and retrieving the target text block corresponding to the structured search instruction from the knowledge base based on a hybrid search mechanism; and integrating the information from the target text block to obtain forensic data corresponding to the electronic data forensics request. This invention significantly improves the usability of the electronic data forensics system, while reducing manual intervention and increasing work efficiency.

Description

Technical Field

[0001] This invention relates to the field of electronic data forensics, and more specifically, to an electronic data forensics method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of artificial intelligence, related AI technologies are also being widely applied in the field of electronic data forensics. The source of electronic data forensics is various electronic devices, including but not limited to mobile phones, computers, servers, and hard drives. These devices store a wealth of data, such as documents, images, videos, communication records, and application data. These devices may involve different operating systems, file systems, and encryption technologies, and also require a high level of expertise in data screening. Traditional AI technologies are ill-suited to the needs of electronic data forensics. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide an electronic data forensics method, apparatus, device and storage medium to solve the problem that existing artificial intelligence technology is difficult to adapt to the needs of electronic data forensics.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows: In a first aspect, the present invention provides an electronic data forensics method, comprising: Standardized text is obtained by converting the format of the acquired multi-source electronic data. The standardized text is divided into text blocks and stored in a knowledge base, and a relationship graph is constructed based on the text blocks; The request for obtaining electronic data forensics is parsed to generate a structured search instruction, and the target text block corresponding to the structured search instruction is retrieved from the knowledge base based on a hybrid search mechanism. Information is integrated from the target text block to obtain forensic data corresponding to the electronic data forensics request.

[0005] In an optional implementation, the step of converting the acquired multi-source electronic data into standardized text includes: If the type of the multi-source electronic data is structured data, then the structured data is preprocessed to obtain a first standardized text; the text preprocessing includes removing consecutive spaces, newlines and tabs, and the structured data includes documents, web pages and PDF files; If the type of the multi-source electronic data is unstructured data, then the unstructured data is split according to preset tags to obtain a second standardized text; the unstructured data includes chat logs, text messages, voice messages, and images.

[0006] In an optional implementation, the step of dividing the standardized text into text blocks and storing them in a knowledge base includes: If the standardized text is the first standardized text, then segmentation rules are set according to the first standardized text, and the segmentation rules include the maximum segment length and the overlap length between segments; The first standardized text is divided into multiple parent text blocks based on the maximum segment length and the overlap length between segments; The parent text block is split into multiple sub-text blocks according to natural semantics; The parent text block and the child text block are stored in the knowledge base according to preset storage rules.

[0007] In an optional implementation, the step of constructing a relationship graph based on the text blocks includes: Generate associated metadata based on the hierarchical relationship between the parent text block and the child text block; Context information between parent text blocks is generated based on the overlap length between segments corresponding to the parent text block. The relationship graph is constructed based on the associated metadata and the context information.

[0008] In an optional implementation, the step of generating structured search instructions by parsing the electronic data forensics request includes: The electronic data forensics request is subjected to intent recognition to determine the request type; Based on the request type, information is extracted from the electronic data forensics request to obtain key request information, and a structured retrieval instruction matching the knowledge base is generated based on the key request information.

[0009] In an optional implementation, the step of retrieving the target text block corresponding to the structured search instruction from the knowledge base based on the hybrid retrieval mechanism includes: If the request type is a simple fact query request, then the keyword retrieval mechanism is invoked to locate the target text block from the knowledge base; If the request type is a fuzzy request, then similar text blocks are located from the knowledge base using a vector similarity calculation mechanism, and associated text blocks corresponding to the similar text blocks are obtained using a context retrieval mechanism. The similar text blocks and the associated text blocks are then used as the target text blocks.

[0010] In an optional implementation, the step of integrating information from the target text block to obtain forensic data corresponding to the electronic data forensics request includes: Redundant content in the target text block is removed to obtain key fields, and the key fields are sorted and integrated according to logical relationships to obtain integrated text; The context information corresponding to the integrated text is determined based on the knowledge graph, and the evidence data is generated using a natural language generation model based on the integrated text and the context information.

[0011] Secondly, the present invention provides an electronic data forensics device, comprising: The format conversion module is used to convert the acquired multi-source electronic data into standardized text. The segmented storage module is used to divide the standardized text into text blocks and store them in the knowledge base, and to construct a relationship graph based on the text blocks; The hybrid retrieval module is used to parse the request for obtaining electronic data forensics into a structured retrieval instruction, and retrieve the target text block corresponding to the structured retrieval instruction from the knowledge base based on the hybrid retrieval mechanism; The answer generation module is used to integrate information from the target text block through the answer generation engine to obtain evidence data corresponding to the electronic data forensics request.

[0012] Thirdly, the present invention provides an electronic device including a processor and a memory, the memory storing machine-executable instructions executable by the processor, the processor executing the machine-executable instructions to implement the electronic data forensics method described in the first aspect.

[0013] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the electronic data forensics method as described in the first aspect.

[0014] The present invention provides an electronic data forensics method, apparatus, device and storage medium that enables non-technical personnel to easily conduct electronic data forensics through natural language interaction, significantly improving the usability of the electronic data forensics system, while reducing manual intervention and improving work efficiency.

[0015] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A block diagram of an electronic device provided by an embodiment of the present invention is shown; Figure 2 A flowchart illustrating an electronic data forensics method provided by an embodiment of the present invention is shown; Figure 3 A flowchart illustrating a text block storage method provided by an embodiment of the present invention is shown; Figure 4 The diagram shows a functional block diagram of an electronic data forensics device provided in an embodiment of the present invention.

[0018] icon: 100 - Electronic device; 110 - Memory; 120 - Processor; 130 - Communication module; 400 - Electronic data forensics device; 410 - Format conversion module; 420 - Segmented storage module; 430 - Hybrid retrieval module; 440 - Answer generation module. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0020] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0021] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0022] Currently, in the field of electronic data forensics, various software programs are available for automating and unattended operations of data extraction and preservation from electronic devices. However, in the subsequent data analysis, data mining, and high-value data screening processes, the storage capacity of devices such as mobile phones and computers (hereinafter collectively referred to as evidence) is increasing exponentially. The data volume of a single evidence often reaches millions or even more. When analyzing the data of these evidences, it is still necessary to have professionals with extensive data analysis experience or a large amount of basic manpower to search, summarize, and extract the desired results. However, the proportion of experienced analysts is often very low, and the analysis process also consumes a lot of time, resulting in a significant decrease in the efficiency of data analysis and making it unable to meet the needs of certain emergency events.

[0023] Furthermore, in this era of rapid information technology development, various new electronic devices are constantly emerging. Meanwhile, some grassroots departments still have outdated equipment that doesn't support automated data extraction. This necessitates that personnel performing data extraction possess extensive experience and stay abreast of cutting-edge technological advancements to quickly retrieve data from various devices in emergency situations. However, such personnel are extremely scarce in actual work environments. Therefore, a common scenario is that when encountering unfamiliar electronic devices, data extraction often requires relying on search engines or remote assistance. This process is time-consuming and may even result in data loss during the experiment.

[0024] To address the aforementioned problems, this embodiment provides an electronic device.

[0025] Please refer to Figure 1 , Figure 1This is a block diagram of an electronic device 100 provided in this embodiment. The electronic device 100 includes a memory 110, a processor 120, and a communication module 130. The memory 110, processor 120, and communication module 130 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0026] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0027] The processor 120 is used to read / write data or programs stored in the memory 110 and to perform corresponding functions.

[0028] The communication module 130 is used to establish a communication connection between the electronic device 100 and other communication terminals through the network, and to send and receive data through the network.

[0029] It should be understood that, Figure 1 The structure shown is only a schematic diagram of the electronic device 100. The electronic device 100 may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown. Figure 1 The components shown can be implemented using hardware, software, or a combination thereof.

[0030] Please refer to Figure 2 , Figure 2 This is a flowchart illustrating an electronic data forensics method provided in this embodiment. The method includes: S210. Convert the acquired multi-source electronic data into a standardized text.

[0031] Multi-source electronic data can be electronic data obtained from various electronic devices, including documents, pictures, tables, videos, voice messages, and chat logs. The format and type of electronic data in different electronic devices may be different. Therefore, data import and conversion interfaces for different types of electronic devices can be built in advance to import electronic data into the same storage space and perform unified format conversion to obtain standardized text in the same format.

[0032] S220. Divide the standardized text into text blocks and store them in the knowledge base, and construct a relationship graph based on the text blocks.

[0033] After obtaining the standardized text, it can be divided into multiple parent text blocks based on information such as the title. Then, based on the subheadings or line breaks contained in the parent text blocks, the parent text blocks can be divided into multiple child text blocks and stored in the knowledge base. Finally, a corresponding relationship graph can be constructed based on the relationship between the text blocks and stored in the knowledge base as well.

[0034] S230. The request for obtaining electronic data forensics is parsed to generate a structured search instruction, and the target text block corresponding to the structured search instruction is retrieved from the knowledge base based on a hybrid search mechanism.

[0035] Different users may upload different electronic data forensics requests. In order for the system to accurately understand the user's forensics needs, it is necessary to perform requirement parsing on the electronic data forensics requests to obtain standard structured search instructions before locating the corresponding target text block.

[0036] S240. Integrate the information of the target text block to obtain the evidence data corresponding to the electronic data evidence request.

[0037] The target text block may contain various information, most of which may not be what the user wants. Therefore, after obtaining the target text block, it is necessary to integrate and extract information from it in order to obtain the evidence data that the user wants.

[0038] This embodiment enables non-technical personnel to easily conduct electronic data forensics through natural language interaction, significantly improving the usability of the electronic data forensics system while reducing manual intervention and increasing work efficiency.

[0039] In one embodiment, the step of converting the acquired multi-source electronic data into standardized text includes: If the type of the multi-source electronic data is structured data, then the structured data is preprocessed to obtain a first standardized text; the text preprocessing includes removing consecutive spaces, newlines and tabs, and the structured data includes documents, web pages and PDF files; If the type of the multi-source electronic data is unstructured data, then the unstructured data is split according to preset tags to obtain a second standardized text; the unstructured data includes chat logs, text messages, voice messages, and images.

[0040] Unstructured data, such as chat messages and SMS data, can be filtered out by removing tags, invalid links, blank characters, etc., and then categorized according to preset tags. Tags can include: title, body content, creation time, etc., to break down unstructured data into structured fields.

[0041] Unstructured data does not require hierarchical parent-child relationships. Instead, the text is simply divided into several independent, peer-level blocks at a fixed granularity (e.g., fixed character count, natural paragraphs). All blocks are at the same level and have no associated metadata bindings. For example, a 500-word news report can be divided into three peer-level blocks at a granularity of approximately 200 words each. Each block contains only its own topic tags and keywords. During retrieval, matching blocks are directly located and retrieved without considering contextual hierarchy. The advantage of this segmentation method is its simple processing flow and high efficiency. It eliminates the need for additional hierarchical division and associated metadata configuration, making it suitable for knowledge base scenarios with small data volumes and simple content structures.

[0042] In one implementation, please refer to Figure 3 Step S220 includes: steps S2201-S2204.

[0043] S2201. If the standardized text is the first standardized text, then a segmentation rule is set according to the first standardized text, and the segmentation rule includes the maximum segment length and the overlap length between segments.

[0044] S2202. Divide the first standardized text into multiple parent text blocks according to the maximum segment length and the overlap length between segments.

[0045] S2203. The parent text block is split into multiple sub-text blocks according to natural semantics.

[0046] S2204. Store the parent text block and the child text block in the knowledge base according to the preset storage rules.

[0047] The parent text blocks need to be divided according to core themes or functional modules. For example, in a technical document, "Core Principles," "Operating Steps," and "Precautions" each constitute a parent text block, ensuring that each parent text block covers a complete topic category. Sub-text blocks are then divided within the parent text blocks according to natural semantics or information granularity. For example, the parent text block "Operating Steps" can be broken down into sub-text blocks such as "Preparation Work," "Core Operational Steps," and "Final Checks." Each sub-text block possesses a complete semantic meaning and can independently serve as a unit for retrieval and text recall.

[0048] In one implementation, the step of constructing a relational graph based on the text blocks includes: Generate associated metadata based on the hierarchical relationship between the parent text block and the child text block; Context information between parent text blocks is generated based on the overlap length between segments corresponding to the parent text block. The relationship graph is constructed based on the associated metadata and the context information.

[0049] After dividing the text into blocks, you can add associated metadata to the parent and child text blocks in the knowledge base, such as parent text block ID, child text block sequence number, topic tag, keywords, etc., to clarify the hierarchical relationship between them.

[0050] For example, for a manual containing multiple product functions, first use "Product A Function Set" and "Product B Function Set" as parent text blocks, and then under the parent text block "Product A Function Set", split it into sub-text blocks such as "Function A1 Operation Guide", "Function A1 Parameter Description", and "Function A2 Operation Guide".

[0051] When searching, if a user queries "How to operate function A1", the system directly retrieves and recalls the "Function A1 Operation Guide" sub-block, achieving precise matching. Simultaneously, it can quickly obtain contextual information such as the product category to which the function belongs by associating metadata with the parent text block. This design ensures both high efficiency in retrieval and recall, while avoiding information fragmentation through parent-child hierarchical association.

[0052] In one implementation, the step of generating a structured search instruction by parsing the electronic data forensics request includes: The electronic data forensics request is subjected to intent recognition to determine the request type; Based on the request type, information is extracted from the electronic data forensics request to obtain key request information, and a structured retrieval instruction matching the knowledge base is generated based on the key request information.

[0053] User questions are usually presented in natural language, such as spoken questions or written inquiries, and are characterized by ambiguity and diversity, as a single question may have multiple ways of being expressed.

[0054] Therefore, the first step is to identify the user's intent in their electronic data forensics request to clarify the purpose of the request. By quickly determining the user's core need type through intent identification, the subsequent retrieval strategy and answer generation method can be determined.

[0055] For example, fact-finding requests should prioritize matching definitional and factual information fragments in the knowledge base; while methodological consultation requests should locate step-by-step and process-oriented information fragments.

[0056] In one implementation, the step of retrieving the target text block corresponding to the structured search instruction from the knowledge base based on the hybrid search mechanism includes: If the request type is a simple fact query request, then the keyword retrieval mechanism is invoked to locate the target text block from the knowledge base; If the request type is a fuzzy request, then similar text blocks are located from the knowledge base using a vector similarity calculation mechanism, and associated text blocks corresponding to the similar text blocks are obtained using a context retrieval mechanism. The similar text blocks and the associated text blocks are then used as the target text blocks.

[0057] The electronic data forensics request is parsed into structured search instructions, such as core keywords, intent types, and constraints, and then passed to the knowledge base. Through the knowledge base's hybrid search mechanism, the most relevant set of information fragments is located.

[0058] For simple fact-finding requests, keyword retrieval can be prioritized to quickly locate information fragments containing core facts. For requests with ambiguous semantics or synonymous expressions, semantic retrieval should be prioritized to match information fragments with deep semantic relevance through semantic vector similarity calculation. For complex requests (such as questions containing multiple sub-questions), context-related retrieval should be combined to uncover the logical relationships between information fragments and form a complete knowledge set.

[0059] For example, if a user asks "the principle of segmented storage and the advantages of hybrid retrieval in AI knowledge bases", the system needs to retrieve information fragments related to "segmented storage principle" and "hybrid retrieval advantages" separately, and integrate them through contextual association to ensure the integrity of the information.

[0060] In one implementation, the step of integrating information from the target text block to obtain forensic data corresponding to the electronic data forensics request includes: Redundant content in the target text block is removed to obtain key fields, and the key fields are sorted and integrated according to logical relationships to obtain integrated text; The context information corresponding to the integrated text is determined based on the knowledge graph, and the evidence data is generated using a natural language generation model based on the integrated text and the context information.

[0061] After locating the target text block, the first step is to integrate and refine the information, that is, to remove redundant content from the information fragments, retain the core key information, and sort and integrate the information according to logical relationships, such as cause and effect, parallelism, and steps.

[0062] Then, a natural language generation model is used to transform the integrated structured information into natural language expressions. For example, for the requirement of "advantages of the hybrid retrieval mechanism", the system retrieves information fragments from the knowledge base such as "fast keyword retrieval", "high accuracy of semantic retrieval", and "contextual association can integrate scattered information". After integration and refinement, it generates a natural language answer: "The hybrid retrieval mechanism combines the advantages of keyword retrieval, semantic retrieval and contextual association retrieval: keyword retrieval enables rapid initial screening, semantic retrieval improves matching accuracy, and contextual association can integrate scattered information, thereby achieving a dual improvement in retrieval efficiency and accuracy."

[0063] To perform the corresponding steps in the above embodiments and various possible methods, an implementation of an electronic data forensics device is given below. Please refer to [link / reference]. Figure 4 , Figure 4 This is a functional block diagram of an electronic data forensics device provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the electronic data forensics device provided in this embodiment are the same as those in the above embodiments. For the sake of brevity, any parts not mentioned in this embodiment can be referred to the corresponding content in the above embodiments. The electronic data forensics device 400 includes: The format conversion module 410 is used to convert the acquired multi-source electronic data into standardized text. The segmented storage module 420 is used to divide the standardized text into text blocks and store them in the knowledge base, and to construct a relationship graph based on the text blocks; The hybrid retrieval module 430 is used to parse the request for obtaining electronic data forensics to generate a structured retrieval instruction, and retrieve the target text block corresponding to the structured retrieval instruction from the knowledge base based on the hybrid retrieval mechanism; The answer generation module 440 is used to integrate information from the target text block through the answer generation engine to obtain evidence data corresponding to the electronic data forensics request.

[0064] Optionally, the above modules can be stored in the form of software or firmware. Figure 1 The memory shown is either stored in or embedded in the operating system (OS) of the electronic data forensics device, and can be used by... Figure 1 The processor executes the commands. Meanwhile, the data and program code required to execute these modules can be stored in memory.

[0065] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0066] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0067] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0068] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for obtaining electronic data forensics, characterized in that, include: Standardized text is obtained by converting the format of the acquired multi-source electronic data. The standardized text is divided into text blocks and stored in a knowledge base, and a relationship graph is constructed based on the text blocks; The request for obtaining electronic data forensics is parsed to generate a structured search instruction, and the target text block corresponding to the structured search instruction is retrieved from the knowledge base based on a hybrid search mechanism. Information is integrated from the target text block to obtain forensic data corresponding to the electronic data forensics request.

2. The electronic data forensics method according to claim 1, characterized in that, The step of converting the acquired multi-source electronic data into standardized text includes: If the type of the multi-source electronic data is structured data, then the structured data is preprocessed to obtain a first standardized text; the text preprocessing includes removing consecutive spaces, newlines and tabs, and the structured data includes documents, web pages and PDF files; If the type of the multi-source electronic data is unstructured data, then the unstructured data is split according to preset tags to obtain a second standardized text; the unstructured data includes chat logs, text messages, voice messages, and images.

3. The electronic data forensics method according to claim 2, characterized in that, The step of dividing the standardized text into text blocks and storing them in the knowledge base includes: If the standardized text is the first standardized text, then segmentation rules are set according to the first standardized text, and the segmentation rules include the maximum segment length and the overlap length between segments; The first standardized text is divided into multiple parent text blocks based on the maximum segment length and the overlap length between segments; The parent text block is split into multiple sub-text blocks according to natural semantics; The parent text block and the child text block are stored in the knowledge base according to preset storage rules.

4. The electronic data forensics method according to claim 3, characterized in that, The step of constructing a relational graph based on the text blocks includes: Generate associated metadata based on the hierarchical relationship between the parent text block and the child text block; Context information between parent text blocks is generated based on the overlap length between segments corresponding to the parent text block. The relationship graph is constructed based on the associated metadata and the context information.

5. The electronic data forensics method according to claim 1, characterized in that, The step of generating structured search instructions by parsing the electronic data forensics request includes: The electronic data forensics request is subjected to intent recognition to determine the request type; Based on the request type, information is extracted from the electronic data forensics request to obtain key request information, and a structured retrieval instruction matching the knowledge base is generated based on the key request information.

6. The electronic data forensics method according to claim 5, characterized in that, The step of retrieving the target text block corresponding to the structured search instruction from the knowledge base based on the hybrid search mechanism includes: If the request type is a simple fact query request, then the keyword retrieval mechanism is invoked to locate the target text block from the knowledge base; If the request type is a fuzzy request, then similar text blocks are located from the knowledge base using a vector similarity calculation mechanism, and associated text blocks corresponding to the similar text blocks are obtained using a context retrieval mechanism. The similar text blocks and the associated text blocks are then used as the target text blocks.

7. The electronic data forensics method according to claim 1, characterized in that, The step of integrating information from the target text block to obtain forensic data corresponding to the electronic data forensics request includes: Redundant content in the target text block is removed to obtain key fields, and the key fields are sorted and integrated according to logical relationships to obtain integrated text; The context information corresponding to the integrated text is determined based on the knowledge graph, and the evidence data is generated using a natural language generation model based on the integrated text and the context information.

8. An electronic data forensics device, characterized in that, include: The format conversion module is used to convert the acquired multi-source electronic data into standardized text. The segmented storage module is used to divide the standardized text into text blocks and store them in the knowledge base, and to construct a relationship graph based on the text blocks; The hybrid retrieval module is used to parse the request for obtaining electronic data forensics into a structured retrieval instruction, and retrieve the target text block corresponding to the structured retrieval instruction from the knowledge base based on the hybrid retrieval mechanism; The answer generation module is used to integrate information from the target text block through the answer generation engine to obtain evidence data corresponding to the electronic data forensics request.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, the processor executing the machine-executable instructions to implement the electronic data forensics method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the electronic data forensics method as described in any one of claims 1-7.

Images