Intelligent automated forensic device and method based on multi-technology fusion

Abstract

Disclosed is an intelligent automated forensics device and method based on multi-technology fusion, comprising a double-layer shell with electromagnetic shielding performance, an optical imaging system and a Wi-Fi forensics module arranged therein; an automated control module for simulating a Bluetooth HID device to realize non-invasive automated control of a mobile phone; and a USB signal switching module for switching signal links between handshaking pairing and high-speed data transmission. The application realizes miniaturization of the device through optical path folding, and uses shielding design to ensure the stability of Wi-Fi 6E / UWB high-speed wireless forensics, solving the problems of traditional forensics relying on manual operation, slow wired transmission and heavy equipment.

Description

Technical Field

[0001] This invention relates to the technical field of electronic data forensics, and in particular to an intelligent automated forensics device and method based on the integration of multiple technologies. Background Technology

[0002] With the rapid development of mobile internet technology and the widespread adoption of smart mobile devices, smartphones and other mobile devices have become an indispensable part of people's daily lives, and also an important medium for obtaining crucial evidence in fields such as investigation and security checks. Therefore, the demand for efficient and standardized electronic data forensics using mobile devices is growing rapidly.

[0003] However, existing mobile phone forensics technologies and equipment still have many shortcomings in practical applications, mainly in the following aspects: First, it relies heavily on manual intervention, which is inefficient and prone to errors. Traditional evidence collection processes typically require personnel to manually enable the device's debugging mode (such as USB debugging) and manually click on the screen step by step according to software prompts. Evidence collection for a single mobile phone often takes several hours, and the work efficiency is extremely low when dealing with batch mobile phone evidence collection tasks. In addition, frequent manual operations are very prone to introducing errors, such as accidentally deleting critical data, omitting important file paths, or operating procedures that are not standardized. This may not only lead to a break in the chain of evidence, failing to meet the stringent requirements of "authenticity, completeness, and traceability" in evidence collection, but may even cause the collected evidence to lose its legal validity.

[0004] Secondly, data transmission methods are limited, resulting in slow speeds and poor stability. Currently, most mainstream evidence collection methods use wired connections, connecting the mobile phone to the evidence collection host's USB port via a data cable. This method is limited by the USB port speed of the host or mobile phone (many older devices still use USB 2.0), leading to extremely slow data transmission of large amounts of data. Simultaneously, the physical interfaces of the evidence collection equipment are prone to oxidation and loosening under frequent, high-frequency plugging and unplugging, resulting in poor contact or unstable connections. This, in turn, causes signal attenuation, transmission interruptions, or frequent retries, severely impacting evidence collection efficiency and success rates.

[0005] Finally, there is a contradiction between device size and imaging quality, and a lack of anti-interference design. To achieve automation, some solutions attempt to introduce cameras to capture images of the screen for evidence. However, to capture the entire phone screen, the physical lens typically needs to maintain a certain focusing distance (e.g., around 8cm), which directly results in a bulky and excessively tall evidence-gathering device, poor portability, and difficulty in meeting the needs of rapid on-site deployment. Furthermore, when attempting wireless evidence gathering, existing evidence-gathering environments often lack effective electromagnetic shielding measures, making Wi-Fi and other wireless signals highly susceptible to external interference, compromising the stability and integrity of data transmission.

[0006] In conclusion, how to develop an intelligent automated forensics device that can reduce human intervention, overcome the bottleneck of wired transmission, and has portability and anti-interference capabilities is a technical problem that urgently needs to be solved in the field of electronic forensics. Summary of the Invention

[0007] To address the aforementioned technical problems in the existing technology, this invention proposes an intelligent automated evidence collection device and method based on the integration of multiple technologies.

[0008] According to a first aspect of the present invention, an intelligent automated forensics device based on multi-technology fusion is proposed, the device comprising: A double-layered shell with electromagnetic shielding effectiveness, physically separated into an upper core shielding cavity and a lower interface cavity; An optical imaging system, located inside the upper core shielding cavity, includes a camera module and a reflector assembly located in front of the camera module. The reflector assembly is configured to fold the physical focusing distance by reflecting the light path through the mirror surface in order to capture the screen image of the device to be examined. The Wi-Fi forensics module is located inside the upper core shielding cavity and is configured to establish a Wi-Fi hotspot supporting ultra-wideband mode in an environment isolated from external electromagnetic interference. The automation control module connects to the host via a serial port and is configured to simulate a Bluetooth human-machine interface device to establish a wireless connection with the device to be authenticated. Based on control commands generated by the host after recognizing the screen image, it sends simulated click signals to the device to be authenticated to activate its Wi-Fi function. The USB signal switching module is connected between the device to be authenticated, the automated control module, and the Wi-Fi authentication module. The USB signal switching module is configured to transmit the USB signal of the device to be authenticated to the automated control module for handshake pairing in the first state, and to switch the USB signal to the Wi-Fi authentication module or the host in response to the control command in the second state, so as to transmit data through the Wi-Fi hotspot.

[0009] In some specific embodiments, the reflector assembly includes a reflective lens and a rotating bracket; the rotating bracket is positioned in front of the lens of the camera module and has an angle adjustment range of 0° to 90°.

[0010] In some specific embodiments, adjusting the angle of the rotating bracket can shorten the physical distance required for the camera module to capture the entire screen of the device to be examined from 8cm in a straight optical path to 4cm in a folded optical path.

[0011] In some specific embodiments, the double-layer shell is made of aluminum alloy; ferrite absorbing sheets are attached to the inner wall of the upper core shielding cavity where signal reflection is strong; conductive foam is filled at the wire connection points of the double-layer shell; and the internal circuit adopts a single-point grounding strategy.

[0012] In some specific embodiments, the automation control module integrates a microcontroller unit; the control pin of the USB signal switching module is connected to the microcontroller unit; when the USB signal switching module is in the first state, the microcontroller unit outputs a high level, enabling the device to be authenticated to connect to the automation control module in host mode, and the automation control module simulates a Bluetooth mouse to pair with the device to be authenticated; when the USB signal switching module is in the second state, the microcontroller unit outputs a low level, enabling the device to be authenticated to switch to device mode and connect to the Wi-Fi authentication module or host.

[0013] In some specific embodiments, the device further includes a USB expansion module; the uplink port of the USB expansion module is connected to the host via a USB 3.0 interface, and the downlink port extends multiple USB signals, which are respectively connected to the camera module, the Wi-Fi evidence collection module, and the automation control module via a serial port module.

[0014] In some specific embodiments, the Wi-Fi forensics module is connected to a touch screen module; the touch screen module is connected to the Wi-Fi forensics module via a MIPI signal to display the forensics process status information of the device to be forensiced.

[0015] In some specific embodiments, the Wi-Fi forensics module supports the Wi-Fi 6E protocol; in the second state, the device to be forensicly examined automatically connects to the hotspot enabled by the Wi-Fi forensics module and uses ultra-wideband bandwidth for data transmission.

[0016] According to a second aspect of the present invention, an intelligent automated forensics method based on multi-technology fusion is proposed, applied to the aforementioned apparatus, the method comprising the following steps: S1: Place the device to be examined in the upper core shielding cavity of the device and connect it to the internal USB interface. Close the shielding cover to isolate external electromagnetic interference. Start the optical imaging system and use the mirror reflection light path of the mirror assembly to collect the screen image of the device to be examined. S2: The automation control module controls the USB signal switching module to be in the first state, so that the device to be tested recognizes the automation control module as an external input device; the automation control module simulates itself as a Bluetooth mouse based on the HID protocol, triggers the Bluetooth pairing request of the device to be tested, and establishes a Bluetooth connection. S3: The host recognizes the screen image collected in step S1 and obtains the current status or lock screen password of the device to be tested; the host generates corresponding control commands and sends them to the automation control module, which sends simulated click or swipe operations to the device to be tested to unlock the screen and enable the Wi-Fi function of the device to be tested and connect to the specified Wi-Fi hotspot. S4: When the device to be certified is successfully connected to the Wi-Fi hotspot, the automation control module controls the USB signal switching module to switch to the second state, disconnects the wired connection between the device to be certified and the automation control module, and switches the signal of the device to be certified to the Wi-Fi certification module or the host; the data of the device to be certified is extracted and backed up through the ultra-wideband channel established by the Wi-Fi certification module.

[0017] In some specific embodiments, S2 specifically includes: the microcontroller unit inside the automation control module sends a high-level signal to the USB signal switching module to configure the USB interface of the device to be certified as host mode, so that it supplies power to the automation control module and establishes a wired connection; after the automation control module and the device to be certified complete Bluetooth pairing, the microcontroller unit sends a low-level signal to the USB signal switching module to switch the device to be certified as device mode, in preparation for the signal switching in the subsequent step S4.

[0018] In some specific embodiments, S3 specifically includes: the host analyzes the real-time image captured by the camera to determine whether the device to be examined is in a locked state; if so, it obtains a preset lock screen password and sends corresponding simulated keyboard and mouse commands through the automation control module to input the password and unlock the screen; after unlocking, the host uses OCR to recognize the system information displayed by the device to be examined and determines whether the device to be examined supports Wi-Fi evidence collection; if it supports it, it continues to perform the operation of turning on the Wi-Fi hotspot; if it does not support it, it maintains the wired connection mode for data evidence collection.

[0019] In some specific embodiments, the host generates a series of simulated operation instructions based on the UI layout of the device to be forensic, including pulling down the status bar or clicking the settings icon to enter the wireless network settings interface; the host uses OCR recognition technology to locate the hotspot name established by the Wi-Fi forensics module in the screen image and generates a click instruction to select the hotspot, so that the device to be forensic automatically connects to the Wi-Fi network that supports ultra-wideband mode.

[0020] In some specific embodiments, before or after the Wi-Fi function is turned on, the device to be examined is controlled to display the International Mobile Equipment Identity (IMSI) by simulating click commands; the ISI is captured by a camera module and extracted by OCR technology, and used as the device identification information in the evidence report.

[0021] In some specific embodiments, the method further includes step S5: after the data extraction is completed, the host automatically generates an evidence collection report containing evidence collection process records, basic device information and backup data, and stores it in the host's local storage.

[0022] Compared with the prior art, the invention, through the above technical solution, has at least the following beneficial effects: 1. Achieving "non-invasive" fully automated evidence collection, significantly improving efficiency and security. This invention simulates standard Bluetooth HID devices (keyboard / mouse) through an automated control module, combined with real-time image recognition of screen content by a camera, constructing an automated closed-loop control system of "visual feedback - command generation - simulated click." Compared to traditional manual operation, this solution eliminates the need for long-term human supervision, avoiding data loss or broken evidence chains due to operational errors. Furthermore, compared to existing technologies that require installing auxiliary apps on mobile phones, this solution does not require root access or the implantation of proxy software, ensuring the originality and validity of electronic evidence.

[0023] 2. Overcoming the bottleneck of wired interfaces to achieve ultra-high-speed wireless data extraction. Addressing the limitation of slow USB 2.0 interface speeds in traditional forensics, this invention utilizes intelligent control of a USB signal switching module to seamlessly switch the data transmission channel to a Wi-Fi forensics module supporting Wi-Fi 6E and Ultra Wideband (UWB) modes after an automated handshake. This design fully leverages the high bandwidth of wireless technology, achieving peak data transmission rates of up to 220MB / s, significantly reducing the extraction time for massive amounts of data, making it particularly suitable for batch mobile phone forensics scenarios.

[0024] 3. Innovative optical path folding design balances imaging range and device portability. This invention introduces a reflective mirror assembly into a compact optical imaging system, utilizing the principle of specular reflection to shorten the physical focusing distance between the camera and the screen from 8cm in direct sunlight to 4cm after folding. This design effectively resolves the contradiction between wide-angle macro shooting and device size, significantly reducing the overall height of the evidence collection device while ensuring the ability to capture the entire mobile phone screen, making it lighter, more portable, and easier to deploy on-site.

[0025] 4. A double-layer shielding structure design ensures the stability and purity of wireless forensics. Considering the sensitivity of wireless forensics to environmental electromagnetic interference, this invention employs a double-layer shell structure with an upper core shielding cavity and a lower interface cavity. Through the combined application of aluminum alloy shielding material, ferrite absorbing sheets, and conductive foam, external electromagnetic interference is effectively isolated, and internal signal leakage and grounding loop interference are suppressed. This provides a stable electromagnetic environment for high-speed Wi-Fi / UWB transmission, preventing transmission interruptions or data verification errors caused by signal fluctuations. Attached Figure Description

[0026] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Other features, objects, and advantages of this application will become more apparent from reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is an embodiment of an intelligent automated forensics device based on multi-technology fusion, which is one embodiment of this application. Figure 2 This is a flowchart of an embodiment of the intelligent automated forensics method based on multi-technology fusion according to this application; Figure 3 This is a flowchart of a specific embodiment of the intelligent automated forensics method based on multi-technology fusion in this application. Detailed Implementation

[0027] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0028] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0029] Figure 1 An embodiment of this application is shown: an intelligent automated forensics device based on multi-technology fusion. For example... Figure 1 As shown, the intelligent automated evidence collection device mainly includes a host 101, a USB expansion module 102, a camera module and reflector assembly 103, a serial port module 104, a WiFi evidence collection module 105, a touch screen module 106, an automation module 107, a USB signal switching module 108, and a mobile phone 109 as the object of evidence collection. Among them: The host 101 serves as the control center of the entire device, responsible for receiving data uploaded by each module, parsing control commands (such as image recognition and voice recognition), and coordinating the collaborative work of each module. The host 101 is connected to the uplink port of the USB expansion module 102 via a USB 3.0 high-speed interface.

[0030] USB expansion module 102 is configured to expand one USB signal from host 101 into multiple downlink signals, which are respectively connected to camera module and reflector assembly 103, serial port module 104 and WiFi evidence collection module 105, so as to realize communication between each functional unit and host.

[0031] The camera module and reflector assembly 103 are the core components of the compact optical imaging system in this embodiment. The camera module (e.g., a wide-angle macro camera) is connected to the USB expansion module 102 via a USB interface to capture images of the phone 109's screen and transmit them to the host 101 for OCR recognition or status assessment. The reflector assembly is positioned in front of the camera lens and folds the physical focusing distance by reflecting light through the mirror surface. This reduces the 8cm shooting distance to 4cm, thereby significantly lowering the height of the internal core shielding cavity while ensuring full screen capture, thus achieving a compact structure.

[0032] The serial port module 104 (e.g., using the FT232RL chip) is connected between the USB expansion module 102 and the automation module 107 to convert the USB signal output by the USB expansion module 102 into a serial port signal, thereby enabling interactive communication between the host 101 and the automation module 107.

[0033] The automation module 107 (e.g., a low-power Bluetooth module based on an ARM-Cortex-M4 core) has MCU functionality and integrates an HID protocol stack. This module communicates with the host 101 via a serial port to receive control commands generated by the host based on visual recognition results; simultaneously, it establishes a connection with the mobile phone 109 via a USB signal switching module 108. The automation module 107 is configured to simulate a Bluetooth keyboard / mouse (HID device), sending simulated click or swipe signals to the mobile phone 109 via Bluetooth wireless connection, achieving non-intrusive automated control.

[0034] The WiFi forensics module 105 (e.g., a smart module based on the Qualcomm QCM6490) is connected to the USB expansion module 102, supporting the Wi-Fi 6E protocol and Ultra Wideband (UWB) mode. This module is configured to create a high-speed Wi-Fi hotspot for the mobile phone 109 to connect to for data extraction. The touchscreen module 106 is connected to the WiFi forensics module 105 via a MIPI interface to display real-time status information of the forensics process.

[0035] The USB signal switching module 108 (e.g., using a TS3USB221DRCR chip) is a key hub connecting the mobile phone 109, the automation module 107, and the WiFi forensics module 105. Its operating state is controlled by the control pins of the MCU inside the automation module 107, specifically including two states: First state (handshake / control state): At this time, the USB signal switching module 108 connects the USB signal of the mobile phone 109 to the automation module 107. The mobile phone 109 is in host mode, powering the automation module 107 and recognizing it as an external device, thereby completing the Bluetooth pairing and HID control handshake between the automation module and the mobile phone.

[0036] Second state (evidence collection / transmission state): When the host 101 detects that data transmission is required, the automation module 107 controls the USB signal switching module 108 to switch the link, connecting the USB signal of the mobile phone 109 to the WiFi evidence collection module 105 (or indirectly connecting it to the host). At this time, the mobile phone 109 switches to device mode and uses the ultra-wideband channel for high-speed data transmission through the connected Wi-Fi hotspot.

[0037] It should be noted that all the above modules (especially the mobile phone 109, camera module and reflector assembly 103, and WiFi forensics module 105) are physically arranged within the upper core shielding cavity of the double-layer shell described in this application to isolate external electromagnetic interference and ensure the high-speed data transmission stability of the WiFi forensics module 105. The lower layer is the interface area, mainly accommodating exposed interfaces to isolate interference sources outside the main shielding area. A small hole allows necessary wires to pass through between the two layers, minimizing electromagnetic leakage gaps. The entire shell is made of aluminum alloy, which offers the highest shielding efficiency. Ferrite absorbing sheets are adhered to areas with strong signal reflection inside the shell to absorb internally reflected electromagnetic waves, preventing resonance and multiple reflections, thereby improving test accuracy. Simultaneously, the internal circuitry employs a single-point grounding strategy to effectively avoid grounding loops, thereby suppressing loop interference and improving the potential stability of the shield. Conductive foam is used to fill gaps at wire connections to ensure continuity and prevent electromagnetic wave leakage from these gaps. Through the above combination design, when the device cover is closed, its internal environment can be completely isolated from external electromagnetic interference, ensuring that the device is not affected by external interference when conducting high-wireless evidence collection.

[0038] Figure 2 A flowchart illustrating an embodiment of the intelligent automated forensics method based on multi-technology fusion of this application is shown, as follows: Figure 2 As shown, the method includes the following steps: S1: Place the device to be examined inside the upper core shielding cavity of the device and connect it to the internal USB interface. Close the shielding cover to isolate external electromagnetic interference. Start the optical imaging system and use the mirror reflection light path of the mirror assembly to collect the screen image of the device to be examined.

[0039] S2: The automation control module controls the USB signal switching module to be in the first state, so that the device to be tested recognizes the automation control module as an external input device; the automation control module simulates itself as a Bluetooth mouse based on the HID protocol, triggers the Bluetooth pairing request of the device to be tested, and establishes a Bluetooth connection.

[0040] In a specific embodiment, S2 specifically includes: the microcontroller unit inside the automation control module sends a high-level signal to the USB signal switching module to configure the USB interface of the device to be certified as host mode, so that it supplies power to the automation control module and establishes a wired connection; after the automation control module and the device to be certified complete Bluetooth pairing, the microcontroller unit sends a low-level signal to the USB signal switching module to switch the device to be certified as device mode, in preparation for the signal switching in the subsequent step S4.

[0041] S3: The host recognizes the screen image collected in step S1 to obtain the current status or lock screen password of the device to be tested; the host generates corresponding control commands and sends them to the automation control module, which sends simulated click or swipe operations to the device to be tested to unlock the screen and enable the Wi-Fi function of the device to be tested and connect to the specified Wi-Fi hotspot.

[0042] In a specific embodiment, S3 specifically includes: the host analyzes the real-time image captured by the camera to determine whether the device to be examined is in a locked state; if so, it obtains a preset lock screen password and sends corresponding simulated keyboard and mouse commands through the automation control module to input the password and unlock the screen; after unlocking, the host uses OCR to recognize the system information displayed by the device to be examined and determines whether the device to be examined supports Wi-Fi evidence collection; if it supports it, it continues to perform the operation of turning on the Wi-Fi hotspot; if it does not support it, it maintains the wired connection mode for data evidence collection.

[0043] In a specific embodiment, the host generates a series of simulated operation commands based on the UI layout of the device to be forensic, including pulling down the status bar or clicking the settings icon to enter the wireless network settings interface; the host uses OCR recognition technology to locate the hotspot name established by the Wi-Fi forensics module in the screen image and generates a click command to select the hotspot, so that the device to be forensic automatically connects to the Wi-Fi network that supports ultra-wideband mode.

[0044] In a specific embodiment, before or after enabling the Wi-Fi function, the device to be certified is controlled to display the International Mobile Equipment Identity (IMSI) by simulating click commands; the ISI is captured by the camera module and extracted by OCR technology, and used as the device identification information in the certification report.

[0045] S4: When the device to be certified is successfully connected to the Wi-Fi hotspot, the automation control module controls the USB signal switching module to switch to the second state, disconnects the wired connection between the device to be certified and the automation control module, and switches the signal of the device to be certified to the Wi-Fi certification module or the host; the data of the device to be certified is extracted and backed up through the ultra-wideband channel established by the Wi-Fi certification module.

[0046] In a specific embodiment, the method further includes step S5: after the data extraction is completed, the host automatically generates an evidence collection report containing evidence collection process records, basic device information and backup data, and stores it in the host's local storage.

[0047] Figure 3 A flowchart illustrating a specific embodiment of this application's intelligent automated forensics method based on multi-technology fusion is shown, such as... Figure 3 As shown, the specific steps are described below: Step 301: Initialization and Connection Status Detection. At the start of the forensics process, the device first initializes. The microcontroller unit (MCU) inside the automation module detects and controls the status of the control pins of the USB signal switching module.

[0048] Step 302: Establish an automated handshake connection (first state). By default, the MCU sets the control pin to a high level. At this time, the USB signal switching module is in the first state, connecting the USB signal of the mobile phone (the device to be verified) to the automation module. After the mobile phone recognizes the connection, it connects to the automation module in host mode. This step is a prerequisite for achieving "non-intrusive" control; only in host mode can the mobile phone power the automation module and recognize it as a peripheral.

[0049] Step 303: Bluetooth Pairing and HID Simulation. After establishing a wired connection, the automation module simulates itself as a Bluetooth keyboard and mouse device based on the HID protocol. The automation module sends a signal to the mobile phone, triggering the phone's Bluetooth function and automatically completing the Bluetooth pairing connection. At this point, a hybrid link of "wired power supply + wireless control" is established.

[0050] Step 304: Signal Channel Switching. After the automation module detects that the Bluetooth pairing connection has been successfully established, its internal MCU issues a command to pull the control pin of the USB signal switching module low.

[0051] Step 305: Enter Device Mode (Second State). In response to a low-level signal, the USB signal switching module disconnects the phone's USB path from the automation module and switches to connect to the WiFi forensics module. At this point, the phone's role is reversed, switching to Device mode. In this state, the phone is ready for subsequent data transmission while maintaining the Bluetooth wireless control link established in step 303.

[0052] Step 306: Visual Feedback and Status Assessment. The intelligent forensic software on the host computer automatically activates the camera module. The camera captures an image of the phone screen through the reflector's optical path and uses an image recognition algorithm (OCR) to determine whether the phone is currently locked.

[0053] Steps 307 to 309: Smart Unlock. If step 306 determines that the phone is in a locked screen state ("Yes"), the process proceeds to the unlock branch: Step 307: The software retrieves the lock screen password from the database or user input.

[0054] Steps 308-309: The host generates control commands and sends them to the automation module via Bluetooth. The automation module executes keyboard and mouse controls, simulating clicks or swipes on the phone screen, entering the password, and unlocking the phone. If step 306 determines that the screen is not locked ("No"), proceed directly to step 310.

[0055] Steps 310 to 311: Equipment information acquisition and capability assessment.

[0056] Step 310: After unlocking, the software will simulate operations to view the phone's basic information.

[0057] Step 311: The system determines whether the phone supports WiFi forensics based on the obtained phone model and system version (especially whether it supports Wi-Fi 6E / UWB high-speed mode).

[0058] Steps 312 to 314: High-speed wireless forensics branch (“Yes”). If the mobile phone supports WiFi forensics, the system executes the following efficient process: Step 312: Use keyboard and mouse commands to automatically open the phone's dialer or settings interface and bring up the IMEI code display page.

[0059] Step 313: The camera captures the IMEI code on the screen and performs OCR recognition, using it as the device's unique identifier. Simultaneously, the system controls the WiFi forensics module to activate a WiFi hotspot supporting ultra-wideband bandwidth. Next, the host computer uses visual feedback to locate the hotspot name in the phone's Wi-Fi settings and uses keyboard and mouse controls to click, causing the phone to automatically connect to the WiFi hotspot.

[0060] Step 314: After the connection is established, in the pure electromagnetic environment provided by the shielded box, confirm permissions by using a keyboard and mouse, and use the Wi-Fi / UWB channel for high-speed data transmission to complete the WiFi certification.

[0061] Step 315: Wired Evidence Collection Branch ("No"). If step 311 determines that the mobile phone does not support WiFi evidence collection, then the system enters wired evidence collection mode. The system maintains the current USB connection (Device mode) and extracts data through the traditional wired method as a compatibility fallback.

[0062] Step 316: Data Backup and Report Generation. Regardless of whether wireless or wired methods are used, after data extraction is complete, the host will back up the phone data to local storage and automatically generate an evidence report containing device information (such as IMEI), operation logs, and extracted data.

[0063] This application proposes an intelligent automated forensic device and method based on multi-technology integration. By designing a shielded structure, the mobile phone is placed inside a shielded box, ensuring that the phone is not interfered with by external signals during WiFi forensic collection, thus enabling more stable data transmission. A camera module and reflector assembly capture the entire phone screen within the shortest possible distance. Then, an automated module simulates keyboard and mouse operations on the phone, performing automated swiping and clicking, thereby completing high-speed wireless connection forensic collection. Through the integration of shielding design, automated control, WiFi forensics, and image optimization, the entire process of "interaction-control-forensics-recording" is automated, reducing manual intervention, shortening the forensic collection cycle, and improving work efficiency.

[0064] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. An intelligent automated evidence collection device based on multi-technology fusion, characterized in that, The device includes: A double-layered shell with electromagnetic shielding effectiveness, wherein the double-layered shell is physically separated into an upper core shielding cavity and a lower interface cavity; An optical imaging system, located inside the upper core shielding cavity, includes a camera module and a reflector assembly located in front of the camera module. The reflector assembly is configured to fold the physical focusing distance through mirror reflection of the light path in order to capture the screen image of the device to be examined. The Wi-Fi forensics module is located inside the upper core shielding cavity and is configured to establish a Wi-Fi hotspot supporting ultra-wideband mode in an environment isolated from external electromagnetic interference. An automated control module connects to the host computer via a serial port and is configured to simulate a Bluetooth human-machine interface device to establish a wireless connection with the device to be examined. Based on control commands generated by the host computer after recognizing the screen image, it sends simulated click signals to the device to be examined to drive it to enable Wi-Fi. A USB signal switching module is connected between the device to be authenticated, the automated control module, and the Wi-Fi authentication module. The USB signal switching module is configured to transmit the USB signal of the device to be authenticated to the automated control module for handshake pairing in a first state, and to switch the USB signal to the Wi-Fi authentication module or the host in response to a control command in a second state, so as to transmit data through the Wi-Fi hotspot.

2. The intelligent automated evidence collection device based on multi-technology fusion according to claim 1, characterized in that, The reflector assembly includes a reflective lens and a rotating bracket; the rotating bracket is located in front of the lens of the camera module and has an angle adjustment range of 0° to 90°.

3. The intelligent automated evidence collection device based on multi-technology fusion according to claim 2, characterized in that, By adjusting the angle of the rotating bracket, the physical distance required for the camera module to capture the entire screen of the device to be examined can be shortened from 8cm in a straight optical path to 4cm in a folded optical path.

4. The intelligent automated evidence collection device based on multi-technology fusion according to claim 1, characterized in that, The double-layer shell is made of aluminum alloy; ferrite absorbing sheets are attached to the inner wall of the upper core shielding cavity where signal reflection is strong; conductive foam is filled at the wire connection points of the double-layer shell; and the internal circuit adopts a single-point grounding strategy.

5. The intelligent automated evidence collection device based on multi-technology fusion according to claim 1, characterized in that, The automated control module integrates a microcontroller unit; the control pin of the USB signal switching module is connected to the microcontroller unit; when the USB signal switching module is in the first state, the microcontroller unit outputs a high level, enabling the device to be authenticated to connect to the automated control module in host mode, and the automated control module simulates a Bluetooth mouse to pair with the device to be authenticated; when the USB signal switching module is in the second state, the microcontroller unit outputs a low level, enabling the device to be authenticated to switch to device mode and connect to the Wi-Fi authentication module or the host.

6. The intelligent automated evidence collection device based on multi-technology fusion according to claim 1, characterized in that, The device also includes a USB expansion module; the upstream port of the USB expansion module is connected to the host via a USB 3.0 interface, and the downstream port extends multiple USB signals, which are respectively connected to the camera module, the Wi-Fi evidence collection module, and the automation control module via a serial port module.

7. The intelligent automated forensic device based on multi-technology fusion according to claim 1, characterized in that, The Wi-Fi forensics module is connected to a touchscreen module; the touchscreen module is connected to the Wi-Fi forensics module via a MIPI signal to display the forensics process status information of the device to be forensiced.

8. The intelligent automated evidence collection device based on multi-technology fusion according to claim 1, characterized in that, The Wi-Fi forensics module supports the Wi-Fi 6E protocol; in the second state, the device to be forensicly examined automatically connects to the hotspot enabled by the Wi-Fi forensics module and uses ultra-wideband bandwidth for data transmission.

9. A smart automated forensics method based on multi-technology fusion, characterized in that, Applied to the apparatus of any one of claims 1-8, the method comprises the following steps: S1: Place the device to be examined in the upper core shielding cavity of the device and connect it to the internal USB interface. Close the shielding cover to isolate external electromagnetic interference. Start the optical imaging system and use the mirror reflection light path of the mirror assembly to collect the screen image of the device to be examined. S2: The automation control module controls the USB signal switching module to be in the first state, so that the device to be tested recognizes the automation control module as an external input device; the automation control module simulates itself as a Bluetooth mouse based on the HID protocol, triggers the Bluetooth pairing request of the device to be tested, and establishes a Bluetooth connection; S3: The host identifies the screen image acquired in step S1 and obtains the current status or lock screen password of the device to be tested; the host generates corresponding control commands and sends them to the automation control module, which sends simulated click or swipe operations to the device to be tested to unlock the screen and enable the Wi-Fi function of the device to be tested and connect to the specified Wi-Fi hotspot. S4: When the device to be certified is successfully connected to the Wi-Fi hotspot, the automation control module controls the USB signal switching module to switch to the second state, disconnects the wired connection between the device to be certified and the automation control module, and switches the signal of the device to be certified to the Wi-Fi certification module or the host; the data of the device to be certified is extracted and backed up through the ultra-wideband channel established by the Wi-Fi certification module.

10. The intelligent automated forensics method based on multi-technology fusion according to claim 9, characterized in that, Specifically, step S2 includes: the microcontroller unit inside the automation control module sending a high-level signal to the USB signal switching module to configure the USB interface of the device to be verified as host mode, enabling it to supply power to the automation control module and establish a wired connection; after the automation control module and the device to be verified complete Bluetooth pairing, the microcontroller unit sends a low-level signal to the USB signal switching module to switch the device to be verified as device mode, preparing for the signal switching in the subsequent step S4.

11. The intelligent automated forensics method based on multi-technology fusion according to claim 9, characterized in that, S3 specifically includes: the host analyzes the real-time image captured by the camera to determine whether the device to be examined is in a locked state; if so, it obtains a preset lock screen password and sends corresponding simulated keyboard and mouse commands through the automation control module to input the password and unlock the screen; after unlocking, the host uses OCR to identify the system information displayed by the device to be examined and determines whether the device to be examined supports Wi-Fi evidence collection; if it supports it, it continues to perform the operation of turning on the Wi-Fi hotspot; if it does not support it, it maintains the wired connection mode for data evidence collection.

12. The intelligent automated forensics method based on multi-technology fusion according to claim 11, characterized in that, The host generates a series of simulated operation commands based on the UI layout of the device to be certified, including pulling down the status bar or clicking the settings icon to enter the wireless network settings interface; the host uses OCR recognition technology to locate the hotspot name established by the Wi-Fi forensics module in the screen image, and generates a click command to select the hotspot, so that the device to be certified can automatically connect to the Wi-Fi network that supports ultra-wideband mode.

13. A smart automated forensics method based on multi-technology fusion according to claim 11 or 12, characterized in that, Before or after enabling the Wi-Fi function, the device to be examined is controlled to display the International Mobile Equipment Identity (IMSI) by simulating click commands; the camera module is used to capture and extract the IMI using OCR technology, which is then used as the device identification information in the evidence report.

14. The intelligent automated forensics method based on multi-technology fusion according to claim 9, characterized in that, The method further includes step S5: after the data extraction is completed, the host automatically generates an evidence collection report containing evidence collection process records, basic device information and backup data, and stores it in the host's local storage.

Images