A multi-path parallel forensics method, device and storage medium

Abstract

This invention relates to the field of automated electronic data forensics, specifically to a multi-channel parallel forensics method, apparatus, and storage medium. The method includes: when a device to be forensiced is connected to a target USB interface, reading the port path of the target USB port and the compartment identifier stored in the port identity chip; based on the compartment identifier, obtaining the high-speed camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same forensics compartment; using the high-speed camera to capture the screen of the device to be forensiced and sending the captured data to a main control computer; configuring the SSID and encryption password of the Wi-Fi hotspot information for the device to be forensiced using forensics software on the main control computer; and after the device to be forensiced connects to the Wi-Fi hotspot, transmitting data from the device to be forensiced to the main control computer through the forensics compartment. This method improves the efficiency and accuracy of multi-channel parallel forensics.

Description

Technical Field

[0001] This invention relates to the field of automated electronic data forensics, specifically to a multi-channel parallel forensics method, apparatus, and storage medium. Background Technology

[0002] Electronic data forensics technology has evolved from the early single-channel serial forensics mode to a multi-channel parallel collaborative forensics system. Early forensics relied on manual operation of each device, which was inefficient. Although current automated forensics technology has achieved parallel processing of multiple devices and automatic correlation analysis of evidence chains, significant bottlenecks still exist in terms of accurate device matching and dynamic collaborative management.

[0003] The shortcomings of existing technologies are mainly reflected in the following aspects: high dependence on manual labor and cumbersome operation. Devices in a single compartment (such as cameras, COM ports, and Wi-Fi) need to be manually configured, which can easily lead to device call errors and affect the continuity of evidence collection; multiple devices are easily confused, as the system can only identify the general attributes of devices (such as port numbers) and cannot associate them with the identity of the evidence collection compartment to which they belong, resulting in a high device confusion rate when multiple compartments are used in parallel; poor dynamic adaptability, as the COM port path is dynamically allocated by the operating system. Hot-plugging of devices or system restarts will destroy the static binding relationship, requiring manual reconfiguration, interrupting the evidence collection process, and affecting the efficiency of continuous operation.

[0004] Existing research mainly focuses on hardware integration optimization, lacking an intelligent management mechanism for precise mapping of software and hardware, which restricts the further development of multi-path parallel forensics technology towards efficiency, accuracy, and automation. Summary of the Invention

[0005] To improve the efficiency and accuracy of multi-channel parallel forensics, in a first aspect, embodiments of this application provide a multi-channel parallel forensics method, the method comprising: When a device to be authenticated is connected to the target USB interface, the port path of the target USB port and the identifier stored in the port identity chip are read. Based on the warehouse identifier, the dynamic mapping table is queried to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse. The dynamic mapping table stores the correspondence between the warehouse identifier of the evidence collection warehouse and the high-speed camera, COM port information and Wi-Fi hotspot information in the warehouse. Bind the port path between the device to be authenticated and the target USB port; The high-speed document scanner camera captures the screen of the device to be used for evidence collection and sends the captured data to the main control computer; the main control computer is connected to all evidence collection compartments via a USB hub; Connect the main control computer to the COM port indicated by the COM port information to send debugging / control commands to the device to be certified; The forensic software on the main control computer is used to configure the SSID and encryption password of the Wi-Fi hotspot information for the device to be forensic, so that the device to be forensic can access the Wi-Fi hotspot of the forensic storage area. After the device to be certified is connected to the Wi-Fi hotspot, the data from the device to be certified is transmitted to the main control computer through the evidence collection compartment.

[0006] In one possible implementation, before the device to be forensicly accessed is connected to the target USB interface, the method further includes: Each evidence collection site is assigned a unique physical identifier, resulting in a site identifier. Scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; establish and dynamically update the dynamic mapping table; The dynamic mapping table is stored in the base database of the main control computer in JSON format.

[0007] In one possible implementation, the hardware device includes at least a USB port, a document camera, a USB-to-COM adapter, and a Wi-Fi module; the collection of hardware information of each device and its associated repository identifier includes: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

[0008] In one possible implementation, establishing and dynamically updating the dynamic mapping table includes: A dynamic mapping table is obtained by establishing a correspondence between the identification of the evidence collection compartment and the high-speed camera, COM port information, and Wi-Fi hotspot information within the compartment; the COM port information is indirectly associated with the compartment identification through the serial number of the USB to COM object. If the COM port information changes or the high-speed document scanner camera is replaced, update the dynamic mapping table, record the change log, and re-execute the steps of querying the dynamic mapping table based on the warehouse identifier to obtain the high-speed document scanner camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same evidence collection warehouse.

[0009] In one possible implementation, the method further includes: If the high-speed document camera fails to start, the step of calling the high-speed document camera to capture the screen of the device to be used for evidence collection is executed again. If the COM port connection fails, repeat the step of connecting the host computer to the COM port indicated by the COM port information. If the Wi-Fi hotspot fails to connect to the network, the step of configuring the SSID and encryption password of the Wi-Fi hotspot information to the device to be authenticated through the forensic software on the main control computer is re-executed; If the retries fail after reaching the preset number, the evidence collection unit will trigger an audible and visual alarm and identify the abnormal hardware device and its associated unit. The abnormal information of the abnormal device will be displayed on the main control computer interface.

[0010] In one possible implementation, the method further includes: The model of the device to be used for evidence collection is identified through the high-speed document scanner's camera. Match the COM port baud rate and Wi-Fi hotspot frequency band according to the model number; Connecting the main control computer to the COM port indicated by the COM port information includes: The main control computer communicates with the device to be certified via serial port through the COM port indicated by the COM port information, at the matched baud rate; The device to be used for evidence collection is connected to the Wi-Fi hotspot of the evidence collection warehouse, including: The device to be examined connects to the Wi-Fi hotspot of the evidence collection warehouse using the matched frequency band.

[0011] Secondly, embodiments of this application provide a multi-channel parallel forensic device, the device comprising: The target USB port reading module is used to read the port path and the identifier stored in the port identity chip of the target USB port when a device to be authenticated is connected to the target USB interface. The dynamic mapping table query module is used to query the dynamic mapping table based on the warehouse identifier to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse. The dynamic mapping table stores the correspondence between the warehouse identifier of the evidence collection warehouse and the high-speed camera, COM port information and Wi-Fi hotspot information in the warehouse. A binding module is used to bind the port path of the device to be authenticated to the target USB port; The data acquisition module is used to call the high-speed camera to capture the screen of the device to be used for evidence collection and send the acquired data to the main control computer; the main control computer is connected to all evidence collection compartments via a USB hub. A connection module is used to connect the main control computer to the COM port indicated by the COM port information, so as to send debugging / control commands to the device to be certified; The networking module is used to configure the SSID and encryption password of the Wi-Fi hotspot information to the device to be forensiced through the forensic software on the main control computer, so that the device to be forensiced can access the Wi-Fi hotspot of the forensic storage room; The wireless transmission module is used to transmit data from the device to be examined to the main control computer through the evidence collection compartment after the device to be examined is connected to the Wi-Fi hotspot.

[0012] In one possible implementation, the device further includes: The warehouse identifier allocation module is used to assign a unique physical identifier to each evidence collection warehouse, thus obtaining the warehouse identifier. The scanning module is used to scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; and establish and dynamically update the dynamic mapping table. The storage module is used to store the dynamic mapping table in JSON format into the basic database of the main control computer.

[0013] In one possible implementation, the hardware device includes at least a USB port, a document camera, a USB-to-COM adapter, and a Wi-Fi module; the scanning module is specifically used for: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

[0014] Thirdly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the aforementioned multi-path parallel forensics methods.

[0015] The multi-channel parallel forensics method provided in this application embodiment reads the port path and the compartment identifier stored in the port identity chip of the target USB port when a device to be forensicly accesses the target USB port. Based on the compartment identifier, a dynamic mapping table is queried to obtain the high-speed camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same forensics compartment. The dynamic mapping table stores the correspondence between the compartment identifier of the forensics compartment and the high-speed camera, COM port information, and Wi-Fi hotspot information within that compartment. The device to be forensicly accessed is bound to the port path of the target USB port. The high-speed camera is invoked to capture the screen of the device to be forensicly accessed, and the captured data is sent to the main control computer. The main control computer is connected to all forensics compartments via a USB hub. The main control computer is connected to the COM port indicated by the COM port information to send debugging / control commands to the device to be forensicly accessed. The forensics software on the main control computer configures the SSID and encryption password of the Wi-Fi hotspot information on the device to be forensicly accessed, enabling the device to access the Wi-Fi of the forensics compartment. Hotspot; after the device to be examined connects to the Wi-Fi hotspot, the data from the device to be examined is transmitted to the main control computer through the evidence collection compartment; thereby improving the efficiency and accuracy of the multi-channel parallel automated evidence collection method. Attached Figure Description

[0016] Figure 1 A schematic diagram of the first process of a multi-parallel forensic method provided in this application embodiment; Figure 2 A schematic diagram of a second process for a multi-parallel forensic method provided in an embodiment of this application; Figure 3 This is a schematic diagram of a multi-channel parallel forensics device provided in an embodiment of this application. Detailed Implementation

[0017] The present invention will be described in detail below through embodiments.

[0018] Electronic data forensics technology has evolved from the early single-channel serial forensics mode to a multi-channel parallel collaborative forensics system. Early forensics relied on manual operation of each device, which was inefficient. Although current automated forensics technology has achieved parallel processing of multiple devices and automatic correlation analysis of evidence chains, significant bottlenecks still exist in terms of accurate device matching and dynamic collaborative management.

[0019] The shortcomings of existing technologies are mainly reflected in the following aspects: high dependence on manual labor and cumbersome operation. Devices in a single compartment (such as cameras, COM ports, and Wi-Fi) need to be manually configured, which can easily lead to device call errors and affect the continuity of evidence collection; multiple devices are easily confused, as the system can only identify the general attributes of devices (such as port numbers) and cannot associate them with the identity of the evidence collection compartment to which they belong, resulting in a high device confusion rate when multiple compartments are used in parallel; poor dynamic adaptability, as the COM port path is dynamically allocated by the operating system. Hot-plugging of devices or system restarts will destroy the static binding relationship, requiring manual reconfiguration, interrupting the evidence collection process, and affecting the efficiency of continuous operation.

[0020] Existing research mainly focuses on hardware integration optimization, lacking an intelligent management mechanism for precise mapping of software and hardware, which restricts the further development of multi-path parallel forensics technology towards efficiency, accuracy, and automation.

[0021] See Figure 1 In a first aspect, embodiments of this application provide a multi-path parallel forensics method, the method comprising: S101, When a device to be authenticated is connected to the target USB interface, read the port path of the target USB port and the identifier stored in the port identity chip.

[0022] The target USB port adopts a dual Type-C / Lightning interface design, supporting direct connection to the mobile phone (Android / iOS) to be examined. It has a built-in port identity chip (a unique identifier of the storage compartment to which the storage port belongs), providing hardware basis for port location in multi-channel parallel scenarios. In addition to mobile phones, the device to be examined can also be a USB flash drive, external hard drive, or other storage device. By adding a "unique identifier for storage device" field to expand the mapping table, the coverage of multi-channel parallel automated forensics can be enriched.

[0023] The Windows WMI interface (or Linux udev mechanism) can be called to read the port path of the target USB port (such as "USB Root Hub (USB 3.0) → Port 2") and the unique identifier of the port identity chip, and locate the target port in multi-path parallel processing.

[0024] Since the device to be used for evidence collection is connected to the evidence collection container via a USB port, data transmission can be achieved via USB wired connection.

[0025] S102, based on the warehouse identifier, query the dynamic mapping table to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse.

[0026] The dynamic mapping table stores the correspondence between the evidence collection compartment's compartment identifier and the high-speed camera, COM port information, and Wi-Fi hotspot information within that compartment.

[0027] Each evidence collection unit is an independent, sealed structure and is the core hardware unit for multi-channel parallel automated evidence collection. It integrates four types of core hardware (USB port, high-speed camera, USB to COM object, and Wi-Fi module) and is assigned a unique physical identifier (composed of "unit serial number + the last 6 digits of the Wi-Fi module MAC address inside the unit", such as "Forensic-01-8A7B6C").

[0028] When the device to be identified is connected to a USB port in a storage unit, the device configuration process for that storage unit is triggered by reading the "unique identifier of the storage unit" associated with the port, without affecting other parallel evidence collection tasks. Configuration commands can be sent to the evidence collection software via a Socket interface, specifying "call the high-speed camera of this storage unit (Camera ID: CAM-SN-202501001)," "connect to the COM port of this storage unit (COM5)," and "connect to the Wi-Fi hotspot of this storage unit (SSID: Forensic-WiFi-01-8A7B6C)," ensuring that single-channel configuration does not interfere with multi-channel parallel processing. The mapping table and configuration commands can be deployed to a cloud server, supporting multiple main control computers to collaboratively manage a large number of evidence collection storage units, building a cross-regional multi-channel parallel evidence collection network to meet large-scale evidence collection needs.

[0029] S103, bind the port path of the device to be certified to the target USB port.

[0030] Once the target USB port of the device to be certified is identified, the communication path between the device to be certified and the USB port of that compartment is bound, and other compartment devices are prohibited from occupying the bandwidth of that port to ensure port independence when multiple channels are running in parallel.

[0031] S104, the high-speed camera is invoked to capture the screen of the device to be used for evidence collection, and the captured data is sent to the main control computer.

[0032] The main control computer connects to all evidence collection compartments via a USB hub. It is an industrial-grade host (supporting more than 16 USB ports) running Windows / Linux operating systems. It is the control core for multi-channel parallel automated evidence collection and stores the unique physical identifier and pre-configuration information of each compartment.

[0033] The document scanner camera can use a 20-megapixel high-definition lens and has a built-in USB device serial number (a unique hardware ID, such as "CAM-SN-202501001"). It is fixedly installed on the top of the compartment (aligned with the screen of the device to be used for evidence collection connected to the USB port) to ensure the accuracy of image capture when multiple channels are used for evidence collection in parallel. The "document scanner camera hardware ID" is pushed to the evidence collection software to ensure that only the camera in this compartment is activated to capture images, avoiding image confusion when multiple channels are used in parallel.

[0034] S105, connect the main control computer to the COM port indicated by the COM port information to send debugging / control commands to the device to be certified.

[0035] When the device to be examined is connected in charging-only mode, the main control computer sends ADB commands through the COM port to switch the device to debug mode, thus allowing deeper access. ADB commands can also be sent through the COM port to control the phone's status to assist in evidence collection, such as unlocking the screen.

[0036] S106, The forensic software on the main control computer configures the SSID and encryption password of the Wi-Fi hotspot information to the device to be forensiced, so that the device to be forensiced can access the Wi-Fi hotspot of the forensic storage room.

[0037] The SSID (Service Set Identifier) ​​is fixed to include a unique identifier for the module (such as "Forensic-WiFi-01-8A7B6C"), while the BSSID (Basic Service Set Identifier) ​​is the MAC address of the Wi-Fi module, ensuring the uniqueness of wireless connections in multi-parallel scenarios.

[0038] S107, after the device to be certified is connected to the Wi-Fi hotspot, the data from the device to be certified is transmitted to the main control computer through the evidence collection compartment.

[0039] Once the Wi-Fi connection is successful, data can be transmitted via the wireless channel.

[0040] The multi-channel parallel forensics method provided in this application embodiment reads the port path and the compartment identifier stored in the port identity chip of the target USB port when a device to be forensicly accesses the target USB port. Based on the compartment identifier, a dynamic mapping table is queried to obtain the high-speed camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same forensics compartment. The dynamic mapping table stores the correspondence between the compartment identifier of the forensics compartment and the high-speed camera, COM port information, and Wi-Fi hotspot information within that compartment. The device to be forensicly accessed is bound to the port path of the target USB port. The high-speed camera is invoked to capture the screen of the device to be forensicly accessed, and the captured data is sent to the main control computer. The main control computer is connected to all forensics compartments via a USB hub. The main control computer is connected to the COM port indicated by the COM port information to send debugging / control commands to the device to be forensicly accessed. The forensics software on the main control computer configures the SSID and encryption password of the Wi-Fi hotspot information on the device to be forensicly accessed, enabling the device to access the Wi-Fi of the forensics compartment. Hotspot; after the device to be examined connects to the Wi-Fi hotspot, the data from the device to be examined is transmitted to the main control computer through the evidence collection compartment; thereby improving the efficiency and accuracy of the multi-channel parallel automated evidence collection method.

[0041] In one example, before the device to be authenticated is connected to the target USB interface, the method further includes: S201, assign a unique physical identifier to each evidence collection warehouse to obtain a warehouse identifier; S202, Scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; establish and dynamically update the dynamic mapping table; S203, the dynamic mapping table is stored in the basic database of the main control computer in JSON format.

[0042] After the main control computer starts up, it scans the connected hardware devices every 3 seconds, filtering out invalid devices (such as USB ports not connected to the device to be authenticated), ensuring the effectiveness of multi-channel parallel data acquisition. The dynamic mapping stored in the main control computer is shown below, completing the initial binding of hardware and warehouse identities, laying the foundation for subsequent differentiation of multi-channel parallel devices: "Forensic-01-8A7B6C": { "usb\_port": "USB Root Hub (USB 3.0)→Port 2", "camera\_id": "CAM-SN-202501001", "com\_port": { "path": "COM5", "vid": "0x067B", "pid": "0x2303", "sn": "COM-SN-001" }, "wifi": { "ssid": "Forensic-WiFi-01-8A7B6C", "bssid": "AA:BB:CC:DD:EE:FF" } The hardware device includes at least a USB port, a document camera, a USB-to-COM adapter, and a Wi-Fi module; the collection of hardware information for each device and its associated warehouse identifier includes: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

[0043] In document scanner camera recognition, the OpenCV library can be used to enumerate all camera devices, read the "hardware serial number" in the USB device manager, and match it with the pre-stored "bin-camera ID" association table to avoid camera call errors when multiple channels are running in parallel. In COM port recognition, the PySerial library can be used to enumerate all COM ports, send commands to read the VID / PID / serial number of the USB-to-COM object, determine its corresponding bin, and solve the problem of dynamic serial port allocation in multi-channel parallel scenarios. The USB-to-COM object can use the PL2303 chip solution, which outputs a configurable COM port. The chip has built-in VID (manufacturer identification code, such as 0x067B), PID (product identification code, such as 0x2303), and serial number (unique identifier, such as "COM-SN-001") to avoid serial port confusion in multi-channel parallel scenarios. Locking the COM port path through the VID / PID / serial number of the USB-to-COM object prevents connection failures caused by dynamic system allocation and ensures serial port stability in multi-channel parallel scenarios. The Wi-Fi module supports 2.4G / 5G dual-band. During Wi-Fi hotspot identification, it calls the system's Wi-Fi scanning interface (such as the Windows netsh command) to filter hotspots with SSIDs containing the prefix "Forensic-WiFi-", extracts the unique identifier and BSSID, and ensures accurate wireless connection when multiple channels are connected in parallel.

[0044] In one example, establishing and dynamically updating the dynamic mapping table includes: Step 1: Establish the correspondence between the evidence collection warehouse identifier and the high-speed camera, COM port information, and Wi-Fi hotspot information within the warehouse to obtain a dynamic mapping table; the COM port information is indirectly associated with the warehouse identifier through the serial number of the USB to COM object. COM port information is dynamically assigned by the operating system (e.g., COM3 may change to COM5 after a computer restart), but the serial number of the USB to COM adapter corresponding to the COM port is fixed. Therefore, by establishing a correspondence between the serial number of the USB to COM adapter and the bay identifier, the correspondence between the bay identifier and the COM port information can be indirectly achieved. In addition to the serial number, the USB to COM adapter may also include a Vendor Identifier (VID) and a Product Identifier (PID), which are also fixed information and do not change like COM ports. The VID and PID serve the same purpose as the serial number, and can also be used to replace the serial number to establish a correspondence between the bay identifier and the VID or PID.

[0045] If the COM port information changes or the high-speed document scanner camera is replaced, update the dynamic mapping table, record the change log, and re-execute the steps of querying the dynamic mapping table based on the warehouse identifier to obtain the high-speed document scanner camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same evidence collection warehouse.

[0046] If a change in the COM port path is detected (e.g., COM5 becomes COM7) or a device is replaced (e.g., a high-speed document scanner camera is replaced), the table entries will be automatically updated and new configuration commands will be pushed synchronously without pausing the overall multi-channel parallel automated evidence collection process.

[0047] In one example, the method further includes: If the high-speed document camera fails to start, the step of calling the high-speed document camera to capture the screen of the device to be used for evidence collection is executed again. If the COM port connection fails, repeat the step of connecting the host computer to the COM port indicated by the COM port information. If the Wi-Fi hotspot fails to connect to the network, the step of configuring the SSID and encryption password of the Wi-Fi hotspot information to the device to be authenticated through the forensic software on the main control computer is re-executed; If the retries fail after reaching the preset number, the evidence collection unit will trigger an audible and visual alarm and identify the abnormal hardware device and its associated unit. The abnormal information of the abnormal device will be displayed on the main control computer interface.

[0048] If the camera is not started, the COM port is not connected, or the Wi-Fi is not connected, the configuration command will be re-sent immediately to avoid single-channel failure affecting multi-channel parallel evidence collection. If the configuration fails 3 times in a row, an audible and visual alarm will be triggered (such as the red light on the warehouse body flashing), and abnormal device information (such as "Forensic-01 warehouse high-speed scanner not responding") will be displayed on the main control computer interface to facilitate accurate troubleshooting by maintenance personnel and ensure the continuity of multi-channel parallel automated evidence collection.

[0049] In one example, the method further includes: The model of the device to be used for evidence collection is identified through the high-speed document scanner's camera. Match the COM port baud rate and Wi-Fi hotspot frequency band according to the model number; Connecting the main control computer to the COM port indicated by the COM port information includes: The main control computer communicates with the device to be certified via serial port through the COM port indicated by the COM port information, at the matched baud rate; The device to be used for evidence collection is connected to the Wi-Fi hotspot of the evidence collection warehouse, including: The device to be examined connects to the Wi-Fi hotspot of the evidence collection warehouse using the matched frequency band.

[0050] The high-speed document scanner camera can integrate an AI module to identify the model of the device to be used for evidence collection. Different models correspond to different baud rates and frequency bands, which can improve the level of intelligence of multi-channel parallel automated evidence collection.

[0051] This invention addresses the shortcomings of existing multi-channel parallel automated forensics technologies by employing a technical approach of "unique hardware identifier + dynamic mapping + automatic configuration," achieving three core technical effects: Efficiency Improvement: No manual selection of equipment or configuration of parameters is required. After the mobile phone is connected to the USB port, all devices are automatically called within 10 seconds. The preparation time for single-channel evidence collection is shortened from the original 5 minutes to less than 1 minute. When multiple channels are in parallel (10 warehouses), the daily evidence collection volume can be increased by more than 2 times, giving full play to the efficiency advantages of multi-channel parallel processing.

[0052] Improved accuracy: By establishing a strong association between "unique warehouse identifier and device hardware ID", it ensures that when a mobile phone accesses a warehouse, it only calls the devices in that warehouse, completely solving the problem of device confusion in multi-channel parallel scenarios. The accuracy of evidence data attribution reaches 100%, eliminating the need for subsequent data verification (the original verification time accounted for 20% of the total evidence collection time) and enhancing the reliability of multi-channel parallel processing.

[0053] Enhanced adaptability: In the face of scenarios such as dynamic COM port allocation, hot-plugging of devices, and computer restarts, the system can automatically update the mapping relationship and configuration parameters within 3 seconds, reducing the interruption time of the evidence collection process from the original 10 minutes to within 0.5 minutes, meeting the stability requirements of continuous batch operations for multi-channel parallel automated evidence collection.

[0054] This invention provides a device-accurate matching solution for multi-channel parallel automated evidence collection. It has broad application scenarios and expansion potential in the field of electronic data forensics. It can be used for batch evidence collection from mobile devices such as smartphones and tablets, supporting a multi-channel parallel operation system composed of more than 20 evidence collection bins, significantly improving case-solving efficiency and shortening the evidence collection cycle. It is also suitable for internal device compliance checks in financial and internet companies (such as auditing employee mobile phone data), enabling simultaneous checks of multiple devices through multi-channel parallel automated evidence collection, avoiding data confusion during multi-device evidence collection, and reducing compliance costs. Furthermore, it can be used for mobile device data filing in government service halls (such as retaining citizen mobile phone service data), supporting simultaneous operation of multiple windows through a multi-channel parallel architecture, achieving convenient "access-and-evidence collection" operation, and improving the efficiency of government services.

[0055] Secondly, embodiments of this application provide a multi-channel parallel forensic device, the device comprising: The target USB port reading module 301 is used to read the port path and the cascade identifier stored in the port identity chip of the target USB port when a device to be authenticated is connected to the target USB interface. The dynamic mapping table query module 302 is used to query the dynamic mapping table according to the warehouse identifier to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse. The dynamic mapping table stores the correspondence between the warehouse identifier of the evidence collection warehouse and the high-speed camera, COM port information and Wi-Fi hotspot information in the warehouse. Binding module 303 is used to bind the port path of the device to be certified to the target USB port; The acquisition module 304 is used to call the high-speed camera to acquire the screen of the device to be used for evidence collection and send the acquired data to the main control computer; the main control computer is connected to all evidence collection compartments through a USB hub. The connection module 305 is used to connect the main control computer to the COM port indicated by the COM port information, so as to send debugging / control commands to the device to be certified; The networking module 306 is used to configure the SSID and encryption password of the Wi-Fi hotspot information to the device to be examined through the forensic software on the main control computer, so that the device to be examined can access the Wi-Fi hotspot of the forensic storage room; The wireless transmission module 307 is used to transmit data from the device to be examined to the main control computer through the evidence collection compartment after the device to be examined is connected to the Wi-Fi hotspot.

[0056] In one possible implementation, the device further includes: The warehouse identifier allocation module is used to assign a unique physical identifier to each evidence collection warehouse, thus obtaining the warehouse identifier. The scanning module is used to scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; and establish and dynamically update the dynamic mapping table. The storage module is used to store the dynamic mapping table in JSON format into the basic database of the main control computer.

[0057] In one possible implementation, the hardware device includes at least a USB port, a document camera, a USB-to-COM adapter, and a Wi-Fi module; the scanning module is specifically used for: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

[0058] In one possible implementation, the scanning module is further configured to: A dynamic mapping table is obtained by establishing a correspondence between the identification of the evidence collection compartment and the high-speed camera, COM port information, and Wi-Fi hotspot information within the compartment; the COM port information is indirectly associated with the compartment identification through the serial number of the USB to COM object. If the COM port information changes or the high-speed document scanner camera is replaced, update the dynamic mapping table, record the change log, and re-execute the steps of querying the dynamic mapping table based on the warehouse identifier to obtain the high-speed document scanner camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same evidence collection warehouse.

[0059] In one possible implementation, the apparatus further includes a retry module, the retry module being configured to: If the high-speed document camera fails to start, the step of calling the high-speed document camera to capture the screen of the device to be used for evidence collection is executed again. If the COM port connection fails, repeat the step of connecting the host computer to the COM port indicated by the COM port information. If the Wi-Fi hotspot fails to connect to the network, the step of configuring the SSID and encryption password of the Wi-Fi hotspot information to the device to be authenticated through the forensic software on the main control computer is re-executed; If the retries fail after reaching the preset number, the evidence collection unit will trigger an audible and visual alarm and identify the abnormal hardware device and its associated unit. The abnormal information of the abnormal device will be displayed on the main control computer interface.

[0060] In one possible implementation, the device further includes: The model identification module is used to identify the model of the device to be used for evidence collection through the high-speed document scanner camera; The model matching module is used to match the baud rate of the COM port and the frequency band of the Wi-Fi hotspot according to the model. The connection module is specifically used for: The main control computer communicates with the device to be certified via serial port through the COM port indicated by the COM port information, at the matched baud rate; The networking module is specifically used for: The device to be examined connects to the Wi-Fi hotspot of the evidence collection warehouse using the matched frequency band.

[0061] Thirdly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the aforementioned multi-path parallel forensics methods.

[0062] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0063] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0064] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are described simply because their systems are similar to the method embodiments; relevant parts can be referred to the descriptions of the method embodiments.

[0065] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes to the above embodiments within the scope of the present invention without departing from the principles and spirit of the present invention.

Claims

1. A multi-path parallel forensics method, characterized in that, The method includes: When a device to be authenticated is connected to the target USB interface, the port path of the target USB port and the identifier stored in the port identity chip are read. Based on the warehouse identifier, the dynamic mapping table is queried to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse. The dynamic mapping table stores the correspondence between the warehouse identifier of the evidence collection warehouse and the high-speed camera, COM port information and Wi-Fi hotspot information in the warehouse. Bind the port path between the device to be authenticated and the target USB port; The high-speed document scanner camera captures the screen of the device to be used for evidence collection and sends the captured data to the main control computer; the main control computer is connected to all evidence collection compartments via a USB hub; Connect the main control computer to the COM port indicated by the COM port information to send debugging / control commands to the device to be certified; The forensic software on the main control computer is used to configure the SSID and encryption password of the Wi-Fi hotspot information for the device to be forensic, so that the device to be forensic can access the Wi-Fi hotspot of the forensic storage area. After the device to be certified is connected to the Wi-Fi hotspot, the data from the device to be certified is transmitted to the main control computer through the evidence collection compartment.

2. The method according to claim 1, characterized in that, Before the device to be authenticated is connected to the target USB interface, the method further includes: Each evidence collection site is assigned a unique physical identifier, resulting in a site identifier. Scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; establish and dynamically update the dynamic mapping table; The dynamic mapping table is stored in the base database of the main control computer in JSON format.

3. The method according to claim 2, characterized in that, The hardware device includes at least a USB port, a high-speed document camera, a USB to COM converter, and a Wi-Fi module; The collection of hardware information for each device and its associated warehouse identifier includes: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

4. The method according to claim 2, characterized in that, The process of establishing and dynamically updating the dynamic mapping table includes: A dynamic mapping table is obtained by establishing a correspondence between the identification of the evidence collection compartment and the high-speed camera, COM port information, and Wi-Fi hotspot information within the compartment; the COM port information is indirectly associated with the compartment identification through the serial number of the USB to COM object. If the COM port information changes or the high-speed document scanner camera is replaced, update the dynamic mapping table, record the change log, and re-execute the steps of querying the dynamic mapping table based on the warehouse identifier to obtain the high-speed document scanner camera identifier, COM port information, and Wi-Fi hotspot information belonging to the same evidence collection warehouse.

5. The method according to claim 1, characterized in that, The method further includes: If the high-speed document camera fails to start, the step of calling the high-speed document camera to capture the screen of the device to be used for evidence collection is executed again. If the COM port connection fails, repeat the step of connecting the host computer to the COM port indicated by the COM port information. If the Wi-Fi hotspot fails to connect to the network, the step of configuring the SSID and encryption password of the Wi-Fi hotspot information to the device to be authenticated through the forensic software on the main control computer is re-executed; If the retries fail after reaching the preset number, the evidence collection unit will trigger an audible and visual alarm and identify the abnormal hardware device and its associated unit. The abnormal information of the abnormal device will be displayed on the main control computer interface.

6. The method according to claim 1, characterized in that, The method further includes: The model of the device to be used for evidence collection is identified through the high-speed document scanner's camera. Match the COM port baud rate and Wi-Fi hotspot frequency band according to the model number; Connecting the main control computer to the COM port indicated by the COM port information includes: The main control computer communicates with the device to be certified via serial port through the COM port indicated by the COM port information, at the matched baud rate; The device to be used for evidence collection is connected to the Wi-Fi hotspot of the evidence collection warehouse, including: The device to be examined connects to the Wi-Fi hotspot of the evidence collection warehouse using the matched frequency band.

7. A multi-channel parallel evidence collection device, characterized in that, The device includes: The target USB port reading module is used to read the port path and the identifier stored in the port identity chip of the target USB port when a device to be authenticated is connected to the target USB interface. The dynamic mapping table query module is used to query the dynamic mapping table based on the warehouse identifier to obtain the high-speed camera identifier, COM port information and Wi-Fi hotspot information belonging to the same evidence collection warehouse. The dynamic mapping table stores the correspondence between the warehouse identifier of the evidence collection warehouse and the high-speed camera, COM port information and Wi-Fi hotspot information in the warehouse. A binding module is used to bind the port path of the device to be authenticated to the target USB port; The data acquisition module is used to call the high-speed camera to capture the screen of the device to be used for evidence collection and send the acquired data to the main control computer; the main control computer is connected to all evidence collection compartments via a USB hub. A connection module is used to connect the main control computer to the COM port indicated by the COM port information, so as to send debugging / control commands to the device to be certified; The networking module is used to configure the SSID and encryption password of the Wi-Fi hotspot information to the device to be examined through the forensic software on the main control computer, so that the device to be examined can access the Wi-Fi hotspot of the forensic storage room; The wireless transmission module is used to transmit data from the device to be examined to the main control computer through the evidence collection compartment after the device to be examined is connected to the Wi-Fi hotspot.

8. The apparatus according to claim 7, characterized in that, The device further includes: The warehouse identifier allocation module is used to assign a unique physical identifier to each evidence collection warehouse, thus obtaining the warehouse identifier. The scanning module is used to scan each hardware device connected to the main control computer at preset time intervals, collect hardware information of each device and its corresponding warehouse identifier; and establish and dynamically update the dynamic mapping table. The storage module is used to store the dynamic mapping table in JSON format into the basic database of the main control computer.

9. The apparatus according to claim 8, characterized in that, The hardware device includes at least a USB port, a document camera, a USB-to-COM adapter, and a Wi-Fi module; the scanning module is specifically used for: Read the port identification chip built into the USB port, and determine the compartment identifier to which the USB port belongs from the port identification chip; Enumerate all available document scanners, read the USB device serial number of the document scanner, and query the association table based on the USB device serial number to determine the warehouse identifier to which the document scanner belongs. The association table stores the correspondence between the warehouse identifier and the USB device serial number of the document scanner in that warehouse. Enumerate all COM ports, read the serial number of the USB to COM object associated with the COM port, determine the compartment identifier corresponding to the USB to COM object based on the serial number, and use the compartment identifier corresponding to the USB to COM object as the compartment identifier to which the COM port belongs. Scan all Wi-Fi hotspot information corresponding to Wi-Fi modules, extract warehouse identifiers from the SSIDs of the Wi-Fi hotspot information, and determine the extracted warehouse identifiers as the warehouse identifiers to which the Wi-Fi hotspots belong.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images