71 results about "Digital evidence" patented technology

The invention provides a digital evidence storage platform based on a block chain. In the platform, a server performs hash operation on a file in response to a request of submitting an electronic format file by a client to obtain a hash value corresponding to the file; the server performs information interaction with the distributed file system, names the file with a corresponding hash value, stores the file and acquires a storage ID of the file; the server performs information interaction with the blockchain network, and submits the hash value, the storage ID and the file creation informationcorresponding to the file to the blockchain network; the blockchain network successfully stores transaction data through the smart contract after consensus and packages the transaction data into blocks, and then returns successfully stored block transaction ID values to the server; and the server locally stores the submitted file and the hash value, the storage ID and the transaction ID corresponding to the file, and returns the storage state information of the file to the client. The authenticity and reliability of the data can be ensured.

A biological evidence collection apparatus provides contact-free drying, storage, identification, and protection against sample switch and contamination of collected biological samples. The apparatus may include the described forensic evidence collection kit which provides a set of tools for the collection and storage of biological evidence. The collection apparatus may also be used as part of a sexual assault evidence collection kit, or a kit for the collection of buccal swabs, and the like.

A handy, low cost, tamper-evident evidence recording device is disclosed. A method and system for utilizing evidence recording devices in improving various business processes such as insurance claims processing, car and equipment rentals, and property leases disputes, is disclosed.

A method for preserving digital evidence of a computer misconduct, the method including the steps of: prior to the misconduct, installing an expansion card capable of retrieving and storing a memory image and register information from a digital electrical computer in which the expansion card is installed; connecting a switch to regulate the expansion card from a location other than the computer; at the time of the misconduct, using the switch to trigger the retrieving and storing of the memory image and the register information into the expansion card; and subsequent to the misconduct, extracting the expansion card to preserve digital evidence of the computer misconduct. This method can be carried out further by subjecting the memory image and register information from the expansion card with another computer to forensic analysis.

A method of providing an evidence collection tool, and an apparatus and method for collecting digital evidence in a domain separation-based mobile device are disclosed. The apparatus includes a target device information collection module, a collection module, a transmission module, and a control module. The target device information collection module collects the system feature information and user identification information of a domain separation-based mobile device. The collection module collects digital evidence using a received evidence collection tool. The control module transfers the user identification information and a previously inputted the investigator authentication key value to a server, transfers the security key from the server to the encryption unit of transmission module, the transmission module encrypts the digital evidence using a received security key and transmits the system feature information to the server, and transfers the evidence collection tool from the server to the collection module.

The system disclosed provides an efficient mechanism for acquiring email and other data from remote systems in a forensically sound manner. Email for users can be requested by investigators from email servers across the country. It is then be automatically acquired and made available to the examiner, subject to approval, and any others he deems have a need-to-know on a web based system. The data can be searched and bookmarked, and the bookmarks shared. Data can also be uploaded manually and combined with email data in the searching, bookmarking, and sharing.

The invention relates to a method for implementing a digital-forensics-oriented digital evidence supervision chain. The method comprises the steps that first, timestamp information, a data package and an unique equipment identification number are extracted, then a Hash algorithm is used for encrypting to form calibration, so that data supervision chain information is formed, and when errors happen to digital evidence, backtracking is conducted according to the data supervision chain to find the time and place in which problems happen. According to the method, the timestamp information is added in the supervision chain information, the time of data changes is recorded, if a third party tampers or deletes the data and the like, the time can be recorded, meanwhile, the Hash algorithm is used for conducting signature validation on all the steps in the evidentiary process, and therefore the place where the errors happen to the digital evidence is effectively positioned. The problem that in the prior art, the time and the place in which the errors happen to the digital evidence can not be uniquely positioned is solved, and the efficiency of digital forensics work is improved.

The invention relates to the technical field of block chains, and discloses a cross-chain anchored block chain heterogeneous system. The system comprises a block chain anchoring chain and at least oneblock chain service chain, the blockchain service chain transmits and stores the evidence on a blockchain anchoring chain by creating a digital evidence for proving that the activity and data of theblockchain service chain cannot be tampered so as to complete evidence storage anchoring; wherein the blockchain anchoring chain uses a first consensus mechanism with high safety and high credibilityto perform consensus, and the consensus mechanism adopted by the blockchain service chain can be different from the first consensus mechanism. The consensus mechanism different from the anchoring chain is adopted in the blockchain service chain, so that each blockchain service chain selects a proper consensus mechanism according to own conditions, and the safety and credibility of the whole blockchain system are improved while each blockchain service chain maintains expandability and high operation efficiency. Evidence storage anchoring of credible evidences is completed, and meanwhile tampering invalidation of all transactions of a service chain is guaranteed.

The present invention provides a system for analyzing forensic digital evidence using an image filter and a method thereof. The system for analyzing forensic evidence using an image filter includes: a duplicator that creates a copy of digital evidence; a verifying unit that discriminates whether a copy and the original of the digital evidence are the same; an original storage that stores the original of the digital evidence; an evidence analyzer that classifies image files for the copy of the digital evidence stored in the original storage, on the basis of an image filtering model created by a learning model in accordance with predetermined categories, and then analyzes the evidence; and a reporting unit that creates a report about the result of evidence analysis. The image evidence analyzer includes an image file extractor, an image filtering model learning unit, an image filter, and a plurality of analyzers.

The invention discloses a method, device and system for protecting electronic evidence. The method for protecting the electronic evidence comprises the following steps: acquiring the environment parameter of an evidence computer, evidence documents in the evidence computer and standard time; packaging the environment parameter, the data documents and the standard time so as to form digital evidence; and storing the digital evidence in random positions in an evidence storage device. According to the method for protecting the electronic evidence, primary evidence documents are not encrypted or recoded, and only the order of the evidence documents in the storage space in the evidence storage device is disturbed, so that the secret leakage preventing protection is conducted on the evidence documents, and the primitiveness of the evidence documents can be better ensured.

A digital fingerprint system used for piracy tracing and digital evidence-collecting comprises: a digital fingerprint generating module, a digital fingerprint storehouse, a digital fingerprint embedding module, a digital fingerprint blind-detection module, a digital fingerprint non-blind detection module and a digital evidence generating module; digital fingerprint method is that: (1) separately normally distributed Gauss signals are adopted as fingerprint signals to construct a digital fingerprint storehouse; (2) a spread spectrum embedding way is adopted to embed the fingerprints into an original copy, which generates a legal copy; (3) the legal copies are distributed and in the distribution process, the legal copies can experience a single copy illegal distribution or encounter a coalition attack, therefore a legal copy is formed; (4) the illegal copies are blindly detected to obtain a suspect copy in a lager scale; (5) the suspect copy obtained after being blindly detected is non-blindly detected; (6) the illegal copy and the original fingerprints obtained in procedure 3 and the coalition information obtained in procedure 5 are submitted as evidence to the court for trial. The digital fingerprint system has the advantages of higher detection efficiency and detection precision, thus can be widely applied in the tracing of multimedia content and piracy evidence-collecting.

The invention relates to an information processing technology, in particular to a digital processing and managing system of court exhibits. The system carries out digital processing on the exhibits for court hearing through a corresponding processing device, thereby leading evidences and relevant information for court hearing to be easy to read, store, manage and retrieve; and information content after processing is stored through the network centralized storage form, thereby ensuring the reliability and the safety of data and facilitating the allocation of data resources. Digital evidences can be stored on a variety of media, thereby brining great convenience to filing and preservation of case files, preventing the damage of the exhibits caused by a variety of reasons, reducing the workload of staff and ensuring the science and the fairness of case trails.

A system and method for proving forgery of digital file using a smart phone proves whether digital file recorded as digital evidence is tampered after the digital file is created, and is used in digital forensic and criminal investigation by proving that the digital file is not forged through the forgery confirmation system, and the digital file is used for substituting for notary fee, and used as data for proving a situation in an incident, data for proving foundation works after building construction, or evidence data for voice file in a threatening case. Since content transmitting information while using smart phone is stored as digital data through screen capture and a list of applications executed before the capture is converted and stored as hash value, the digital information authentication system through smart phone screen capture confirms actual facts thereafter by proving that the corresponding content is an original copy.

An apparatus and method for collecting digital evidence from a target system to be analyzed at a remote location and then providing security in a remote digital forensic environment based on the collected digital evidence. The method of providing security includes making, by a security providing apparatus, an evidence collection request for collection of evidence of an evidence collection-target apparatus from an evidence collection agent in a remote digital forensic environment, collecting evidence data corresponding to the evidence collection request from the evidence collection agent, verifying the evidence data based on a signature value of the evidence data collected from the evidence collection agent, generating evidence analysis data based on the verified evidence data, verifying the evidence analysis data based on a signature value of the evidence analysis data, and providing security for the evidence collection-target apparatus based on results of the verification of the evidence analysis data.

The invention relates to the field of digital evidence collection, and specifically relates to an evidence graph and vulnerability reasoning combined network evidence collection method and system. The method comprises the steps of collecting original data from heterogeneous data sources; storing the original data, thereby obtaining first storage data; separating evidence from the first storage data by use of a classification and recognition algorithm; marking the evidence, thereby obtaining event vectors of the evidence; establishing an evidence library according to the first storage data, the evidence and the event vectors; establishing an evidence graph according to the evidence library and an effective time sequence; and reasoning suspicious attack nodes through a VERA algorithm according to the evidence graph and simulating attack paths. Through adoption of the heterogeneous data sources, the comprehensiveness and integrity of the data sources can be ensured. The obtained evidence can be visually reflected by the VERA. According to the method, the problems that in the evidence collection process at the present stage, integrity and authenticity are poor and the obtained evidence cannot be reflected visually can be solved.

The invention relates to an OOXML (office open extensible markup language)-based electronic document digital evidence collecting method and a device thereof. The Office Open XML (OOXML) file format is a new file format adopted by Microsoft office 2007 and later versions. The method disclosed by the invention can collect relevant evidences from a suspected electronic file, such as author information, tampering time information, hidden secret file information and the like, so as to judge the copyright attribution of the electronic file and detect the confidential information and the like. The process of electronic file digital evidence collection does not alter any content of the electronic file, and the collected characteristics have strong robustness. Moreover, the method can resist attacks such as Save As, Delete, Edit, Copy and the like, and can be used for safety control of confidential information covering national defense, politics and commerce.

The invention belongs to the technical field of digital forensics, and particularly relates to a malicious code fragment intelligent forensics method and system, and the method comprises the steps: constructing a code fragment training set and a code fragment test set for training and testing through extracting the underlying data features of a storage medium; training the set full-connection neural network model by using the data in the code fragment training set, the input being a feature vector, and the output being a normal or malicious prediction result; for the code fragment test set, performing test output by utilizing the trained full-connection neural network model to judge whether model input is a malicious code fragment; and performing feature extraction on the target code snippets, and inputting the target code snippets into a fully-connected neural network model generated through training and testing to obtain an intelligent malicious code recognition result of the targetcode snippets. According to the method, malicious code fragments in storage media such as computers, mobile phones and tablets and evidence containers such as RAW, E01 and AFF can be recognized, and the method has a good application prospect in the field of digital evidence collection such as crime event evidence underlying data automatic analysis.

The invention discloses a multimedia digital watermark evidence taking mobile phone. The multimedia digital watermark evidence taking mobile phone is an intelligent evidence taking mobile phone whichuses the unique stability, concealment, security and fragility of a fragile digital watermark to ensure the integrity, the authenticity, the stability, the reliability and the authority of photographed and recorded multimedia data based on an image, audio and video fragile digital watermark embedding and extraction technology. When a user uses the mobile phone, imperceptible and unmodifiable fragile digital watermark information with unique identity confirmation is embedded in real time in a photographed image, audio and video. The image or the audio or the video with the fragile watermark canbe normally used and distributed but can not be modified manually. The authenticity of a file can be identified according to whether the photographed digital file contains the digital watermark information. The evidence taking process is quick, efficient, accurate, safe and convenient. The evidence taking content has the uniqueness of a digital evidence and the legal authority of evidence use, and the multimedia digital watermark evidence taking mobile phone disclosed in the invention can be used for evidence taking and recording in fields such as judicature, law enforcement and claim.

The invention discloses a distributed log auditing system and method based on a state channel. The system comprises a state processing and storing unit in a log server, a block chain network containing a multi-party state channel contract and a log auditing unit of an external auditor. The state processing and storing unit in the log server is used for preprocessing logs, generating a local log state and a global log state and interacting with the block chain; the block chain network of the efficient multi-party state channel contract is used for protecting the security and integrity of the log state, and realizing the under-chain confirmation of the state through the state channel; and the log auditing unit of the external auditor is used for auditing the server log record and automatically obtaining an auditing result. The distributed log auditing system based on the state channel provided by the invention can provide a reliable and safe log integrity protection method for users in the fields of computer intrusion detection, digital evidence collection and the like.

The invention relates to a reading pen technology-based multimedia forensic evidence demonstration method and a reading pen technology-based multimedia forensic evidence demonstration system. The method comprises the following steps that: an evidence acquisition device converts acquired non-digital evidences into digital evidence files and transmits the digital evidence files to an evidence processing module for editing; an information management server lays out the edited evidence files to form an evidence list; a plaintiff or defendant selects the evidence file from the evidence list by using a reading pen and transmits evidence demonstration request information to an evidence demonstration control device; and finally a judge controls the evidence demonstration according to the details of a case. The method and device used by the method are simple and easy to operate, so that efficient and intuitive evidence demonstration is ensured in the court trial so as to save not only the trial time but also a large amount of expenditure.