CN114138346A - Terminal evidence obtaining method and device, electronic equipment and storage medium - Google Patents

The embodiment of the invention discloses a terminal evidence obtaining method, a terminal evidence obtaining device, electronic equipment and a storage medium, relates to the technical field of computer evidence obtaining, and can solve the problem that different computer hardware architecture types correspond to different virtual simulation analysis software in the existing evidence obtaining method and inconvenience is brought to evidence obtaining personnel. The terminal forensics method comprises the steps of importing a disk mirror image corresponding to a terminal to be forensics, configuring boot startup parameters, matching a kernel file corresponding to the disk mirror image from a plurality of kernel files arranged in the terminal according to the boot startup parameters, and starting an operating system according to the kernel file to carry out system simulation so as to obtain forensics results. The method is suitable for the terminal evidence obtaining scene of the multi-computer hardware architecture type, and can improve the evidence obtaining efficiency.

Terminal evidence obtaining method and device, electronic equipment and storage medium

Technical Field

The invention relates to the technical field of computer forensics, in particular to a terminal forensics method and device, electronic equipment and a storage medium.

Background

A large amount of private information of a user is reserved in a computer system and can be used for evidence obtaining. However, the computer hardware has more types, and is more complicated when being matched with corresponding different virtual simulation analysis software, so that inconvenience is brought to the evidence obtaining personnel.

Disclosure of Invention

In view of this, embodiments of the present invention provide a terminal forensics method, apparatus, electronic device, and storage medium, so as to solve the problem that different computer hardware architecture types correspond to different virtual simulation analysis software in the existing forensics method, which is inconvenient for forensics staff.

In a first aspect, an embodiment of the present invention provides a terminal forensics method, including:

importing a disk mirror image corresponding to a terminal to be forensics;

configuring boot startup parameters;

matching a kernel file corresponding to the disk mirror image from a plurality of kernel files arranged in the disk mirror image according to the boot startup parameters;

and starting an operating system according to the kernel file to perform system simulation so as to obtain a forensics result.

According to a specific implementation manner of the embodiment of the present invention, before the importing the disk image corresponding to the terminal to be forensics, the method further includes:

starting the terminal to be subjected to evidence obtaining through the starting disc;

and obtaining the disk mirror image corresponding to the terminal to be subjected to evidence obtaining through a copy instruction.

According to a specific implementation manner of the embodiment of the present invention, the method further includes:

acquiring a hard disk of a terminal to be subjected to evidence obtaining;

and reading the hard disk of the terminal to be subjected to evidence obtaining through a disk copying machine to derive a disk mirror image corresponding to the terminal to be subjected to evidence obtaining.

According to a specific implementation manner of the embodiment of the present invention, the boot startup parameters include:

the disk image evidence number, the disk ID of the image, the image size, the image operating system type, the image operating system instruction set and the starting mode.

Further, the start-up mode includes: MBR start-up mode and UEFI start-up mode.

According to a specific implementation manner of the embodiment of the present invention, the matching of the kernel file corresponding to the disk image according to the boot startup parameter from a plurality of kernel files provided in the disk image includes:

and matching a kernel file corresponding to the disk image according to the type of the image operating system.

According to a specific implementation manner of the embodiment of the present invention, the starting of the operating system according to the kernel file includes:

reading a preset memory address in a first sector of a hard disk of a evidence obtaining device;

judging whether the memory address is the same as a preset starting mark or not;

if so, loading the disk image corresponding to the terminal to be subjected to evidence obtaining to a boot area of a starting mode;

and the boot area of the boot mode reads and writes the kernel file to finish the boot process of the operating system corresponding to the matched disk mirror image.

In a second aspect, an embodiment of the present invention provides a terminal forensics apparatus, including:

the import module is used for importing the disk mirror image corresponding to the terminal to be subjected to evidence obtaining;

the configuration module is used for configuring boot startup parameters;

the matching module is used for matching a kernel file corresponding to the disk mirror image from a plurality of kernel files arranged in the matching module according to the boot startup parameters;

and the starting module is used for starting an operating system according to the kernel file to perform system simulation so as to obtain a forensics result.

In a third aspect, an embodiment of the present invention provides an electronic device, where the electronic device includes: the device comprises a shell, a processor, a memory, a circuit board and a power circuit, wherein the circuit board is arranged in a space enclosed by the shell, and the processor and the memory are arranged on the circuit board; a power supply circuit for supplying power to each circuit or device of the electronic apparatus; the memory is used for storing executable program codes; the processor reads the executable program codes stored in the memory to run programs corresponding to the executable program codes, and is used for executing the terminal evidence obtaining method in any one of the implementation modes.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium storing one or more programs, where the one or more programs are executable by one or more processors to implement the terminal forensics method according to any one of the foregoing implementations.

According to the terminal evidence obtaining method, the terminal evidence obtaining device, the electronic equipment and the storage medium, the disk image corresponding to the terminal to be proved is led in, the boot startup parameters are configured, the kernel file corresponding to the disk image is matched from the various kernel files arranged in the terminal according to the boot startup parameters, the operating system is started according to the kernel file to perform system simulation so as to obtain the evidence obtaining result, the problem that inconvenience is caused to evidence obtaining personnel due to the fact that different computer hardware architecture types correspond to different virtual simulation analysis software in the existing evidence obtaining method can be solved, and the evidence obtaining efficiency is improved.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a flowchart of a terminal forensics method according to an embodiment of the invention;

fig. 2 is a flowchart of a second terminal forensics method according to an embodiment of the present invention;

FIG. 3 is a functional block diagram of a terminal forensics apparatus according to an embodiment of the invention;

fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the described embodiments are only some embodiments of the invention, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The embodiment provides a terminal forensics method, which is used for solving the problem that different computer hardware architecture types correspond to different virtual simulation analysis software in the existing forensics method, so that inconvenience is brought to forensics staff.

Fig. 1 is a schematic flowchart of a terminal forensics method according to a first embodiment of the present invention, and as shown in fig. 1, the terminal forensics method according to the present embodiment is applied to an electronic device.

The terminal forensics method of the embodiment may include:

102, configuring boot startup parameters;

103, matching a kernel file corresponding to the disk mirror image from a plurality of kernel files arranged in the disk mirror image according to the boot startup parameters;

In the process of the traditional terminal evidence obtaining method, because the types of computer hardware architectures are more, such as CPUs (central processing units) such as dragon cores, sealights, Feiteng, Shenwei and the like, each type of computer hardware architecture corresponds to different virtual simulation analysis software, and inconvenience is brought to evidence obtaining personnel.

In this embodiment, by importing a disk image corresponding to a terminal to be forensics, configuring boot startup parameters, matching kernel files corresponding to the disk image from a plurality of kernel files set in the terminal according to the boot startup parameters, and starting an operating system according to the kernel files to perform system simulation to obtain forensics results, the problem that different computer hardware architecture types correspond to different virtual simulation analysis software in the existing forensics method, inconvenience is brought to forensics staff, and forensics efficiency is improved.

Fig. 2 is a flowchart of a terminal forensics method according to a second embodiment of the present invention, and as shown in fig. 2, the terminal forensics method according to the present embodiment may include:

in this embodiment, before importing the disk image corresponding to the terminal to be forensics, the method further includes:

starting the terminal to be subjected to evidence obtaining through the starting disc;

and obtaining the disk mirror image corresponding to the terminal to be subjected to evidence obtaining through the copy instruction. The copy instruction is, for example, a DD instruction.

Or,

acquiring a hard disk of a terminal to be subjected to evidence obtaining;

and reading the hard disk of the terminal to be subjected to evidence obtaining through a disk copying machine to derive a disk mirror image corresponding to the terminal to be subjected to evidence obtaining.

in this embodiment, the start mode includes but is not limited to: MBR (Master Boot Record) Boot mode and UEFI (Unified Extensible Firmware Interface) Boot mode.

The mirror image operating system instruction set is used for carrying out virtual control after the operating system is started so as to obtain a forensics result.

And step 203, matching a kernel file corresponding to the disk image according to the type of the image operating system.

The kernel file is stored in the system and can be searched according to the type index of the mirror image operating system.

for example, a first Sector (0 head, 0 track, 1 Sector, Boot Sector) of the hard disk is read into a memory address 0000: 7c 00;

and step 207, reading and writing the kernel file in the boot mode boot area, and completing the boot process of the operating system corresponding to the matched disk image.

In some embodiments, after the configuring the boot startup parameter is completed, the method further includes: BIOS (Basic Input Output System) power-on self-test;

if the Boot mode is MBR, a Boot Loader program (generally occupying 416 bytes in the first physical sector of the Boot disk) in the MBR finds a kernel file of the disk image file which is in emulation operation according to the Boot parameters, and the kernel program completes the Boot process of the operating system.

In this embodiment, by storing the kernel files corresponding to the plurality of different operating systems and matching the kernel files corresponding to the disk image according to the type of the image operating system, the method and the device can be applied to terminal evidence obtaining work of different operating systems, and improve evidence obtaining efficiency.

Through the technical solutions of the method embodiments shown in fig. 1 and fig. 2, the method and the device can be applied to terminal forensics work of different operating systems; the efficiency of collecting evidence can also be promoted.

Fig. 3 is a schematic structural diagram of a terminal forensics apparatus according to a first embodiment of the present invention, and as shown in fig. 3, the apparatus of this embodiment may include:

In some embodiments, on the basis of the previous embodiment, the apparatus of this embodiment further includes:

and matching a kernel file corresponding to the disk image according to the type of the image operating system.

reading a preset memory address in a first sector of a hard disk of a evidence obtaining device;

judging whether the memory address is the same as a preset starting mark or not;

if so, loading the disk image corresponding to the terminal to be subjected to evidence obtaining to a boot area of a starting mode;

and the boot area of the boot mode reads and writes the kernel file to finish the boot process of the operating system corresponding to the matched disk mirror image.

The apparatus of this embodiment may be used to implement the technical solutions of the method embodiments shown in fig. 1 and fig. 2, and the implementation principles and technical effects are similar, which are not described herein again.

The electronic device exists in a variety of forms, including but not limited to:

(1) a mobile communication device: such devices are characterized by mobile communications capabilities and are primarily targeted at providing voice, data communications. Such terminals include: smart phones (e.g., iphones), multimedia phones, functional phones, and low-end phones, among others.

(2) Mobile personal computer device: the equipment belongs to the category of personal computers, has calculation and processing functions and generally has the characteristic of mobile internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as ipads.

(3) A portable entertainment device: such devices can display and play multimedia content. This type of device comprises: audio, video players (e.g., ipods), handheld game consoles, electronic books, and smart toys and portable car navigation devices.

(4) A server: the device for providing the computing service comprises a processor, a hard disk, a memory, a system bus and the like, and the server is similar to a general computer architecture, but has higher requirements on processing capacity, stability, reliability, safety, expandability, manageability and the like because of the need of providing high-reliability service.

(5) And other electronic equipment with data interaction function.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium storing one or more programs, where the one or more programs are executable by one or more processors to implement the terminal forensics method described in any of the foregoing embodiments.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments.

In particular, as for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

For convenience of description, the above devices are described separately in terms of functional division into various units/modules. Of course, the functionality of the units/modules may be implemented in one or more software and/or hardware implementations of the invention.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.

The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.