CN109766725A

CN109766725A - A kind of data processing method, equipment, intelligent terminal and computer-readable medium

Info

Publication number: CN109766725A
Application number: CN201811559476.3A
Authority: CN
Inventors: 赵浩然; 刘洋
Original assignee: Chongqing Hualong Addie Information Technology Co Ltd
Current assignee: Chongqing Hualong Addie Information Technology Co Ltd
Priority date: 2018-12-19
Filing date: 2018-12-19
Publication date: 2019-05-17
Anticipated expiration: 2038-12-19
Also published as: CN109766725B

Abstract

The embodiment of the invention discloses a kind of data processing method, equipment, intelligent terminal and computer-readable mediums, wherein method includes: that the local zone time for browser client of collecting evidence is synchronized processing with the clock information got from time service equipment when detecting that evidence obtaining browser client is turned on；The target category of evidence obtaining instruction is determined according to the user's operation of triggering evidence obtaining instruction, and according to the corresponding relationship of the classification of preset evidence obtaining instruction and evidence obtaining rule, determines target evidence obtaining rule corresponding with the target category of evidence obtaining instruction；It is collected evidence according to the page that target evidence obtaining rule shows evidence obtaining browser client, obtains forensic data associated with the page that evidence obtaining browser client is shown；Forensic data and evidence obtaining temporal information are packaged, evidence packet is generated, evidence packet is sent to server, it can be achieved that collecting evidence to web data, web data is prevented to be tampered, improves the safety of web data and the validity as evidence.

Description

A kind of data processing method, equipment, intelligent terminal and computer-readable medium

Technical field

The present invention relates to field of information security technology more particularly to a kind of data processing method, equipment, intelligent terminal and meters Calculation machine readable medium.

Background technique

With the fast development of information technology, network has become essential a part in people's life, to society Bring great role and convenience.Meanwhile network also brings many illegal activities, such as online infringement, network to violate to society Crime, network swindle etc., these illegal activities bring very big threat to the person and property safety of people.However, website is mutual The important carrier that content of networking provides implements illegal incidents on webpage and emerges one after another as Websites quantity increases sharply.Therefore, such as What administer to internet and the harmful content as defined in national laws on network is audited and managed, and becomes current Research hotspot.

Summary of the invention

The embodiment of the present invention a kind of data processing method, equipment, intelligent terminal and computer-readable medium are provided, it can be achieved that It collects evidence to web data, web data is prevented to be tampered or delete, improve the safety of web data and as card According to validity.

In a first aspect, the embodiment of the invention provides a kind of data processing methods, this method comprises:

When detecting that evidence obtaining browser client is turned on, clock information is obtained from specified time service equipment, and will The local zone time of the evidence obtaining browser client synchronizes processing with the clock information got from the time service equipment；

In the local zone time to the evidence obtaining browser client and the clock information got from the time service equipment After synchronizing processing, if get evidence obtaining instruction, according to trigger it is described evidence obtaining instruction user's operation determine described in Collect evidence the target category of instruction, and according to the corresponding relationship of the classification of preset evidence obtaining instruction and evidence obtaining rule, it is determining with it is described The corresponding target evidence obtaining rule of the target category instructed of collecting evidence, wherein the classification of different evidence obtaining instructions corresponds to different evidence obtainings Rule；

Collected evidence according to target evidence obtaining rule to the page that show of evidence obtaining browser client, and obtain and The associated forensic data of the page that the evidence obtaining browser client is shown, wherein the forensic data includes page screenshot With page associated data；

The evidence obtaining browser client carries out at time synchronization with the specified time service equipment during obtaining evidence obtaining Evidence obtaining temporal information after reason, and the forensic data and the evidence obtaining temporal information are packaged, evidence packet is generated, and The evidence packet is sent to server.

Second aspect, the embodiment of the invention provides a kind of data processing equipment, which includes:

Synchronization unit, for being obtained from specified time service equipment when detecting that evidence obtaining browser client is turned on Clock information, and by the local zone time of the evidence obtaining browser client and the clock information that gets from the time service equipment Synchronize processing；

Determination unit, for being obtained in the local zone time to the evidence obtaining browser client with from the time service equipment To clock information synchronize processing after, if get evidence obtaining instruction, according to trigger it is described evidence obtaining instruction user Operation determines the target category of the evidence obtaining instruction, and according to the corresponding pass of the classification of preset evidence obtaining instruction and evidence obtaining rule System, determining target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, wherein the classification pair of different evidence obtaining instructions Answer different evidence obtaining rules；

Evidence obtaining unit, the page for being shown according to target evidence obtaining rule to the evidence obtaining browser client carry out Evidence obtaining, and obtain forensic data associated with the page that the evidence obtaining browser client is shown, wherein the forensic data Including page screenshot and page associated data；

Transmission unit, for obtain during evidence obtaining the evidence obtaining browser client and the specified time service equipment into Evidence obtaining temporal information after row time synchronizing, and the forensic data and the evidence obtaining temporal information are packaged, it is raw Server is sent at evidence packet, and by the evidence packet.

The third aspect, the embodiment of the invention provides a kind of intelligent terminals, including processor, input equipment, output equipment And memory, the processor, input equipment, output equipment and memory are connected with each other, wherein the memory is for storing Server is supported to execute the computer program of the above method, the computer program includes program instruction, and the processor is matched It sets for calling described program to instruct, the method for executing above-mentioned first aspect.

5th aspect, the embodiment of the invention provides a kind of computer readable storage medium, the computer storage medium It is stored with computer program, the computer program includes program instruction, and described program instruction makes institute when being executed by a processor State the method that processor executes above-mentioned first aspect.

The embodiment of the present invention is by getting the local zone time for browser client of collecting evidence with from the time service equipment Clock information synchronize processing, and when getting evidence obtaining instruction on the evidence obtaining browser client, to the evidence obtaining The page that browser client is shown is collected evidence, and is obtained associated with the page that the evidence obtaining browser client is shown Forensic data, and the forensic data and the evidence obtaining temporal information are packaged and generate evidence packet, thus by the card Server is sent to according to packet.The evidence obtaining to web data may be implemented in this way, web data is prevented to be tampered or delete It removes, improves the safety of web data and the validity as evidence.

Detailed description of the invention

Technical solution in order to illustrate the embodiments of the present invention more clearly, below will be to needed in embodiment description Attached drawing is briefly described, it should be apparent that, drawings in the following description are some embodiments of the invention, general for this field For logical technical staff, without creative efforts, it is also possible to obtain other drawings based on these drawings.

Fig. 1 is a kind of structural schematic diagram of data processing system provided in an embodiment of the present invention；

Fig. 2 is a kind of schematic flow diagram of data processing method provided in an embodiment of the present invention；

Fig. 3 a is a kind of login interface schematic diagram provided in an embodiment of the present invention；

Fig. 3 b is a kind of time synchronization interface schematic diagram provided in an embodiment of the present invention；

Fig. 3 c is the interface schematic diagram after a kind of time synchronization provided in an embodiment of the present invention；

Fig. 4 a is the interface schematic diagram that a kind of user provided in an embodiment of the present invention logs in；

Fig. 4 b is the interface schematic diagram that another user provided in an embodiment of the present invention logs in；

Fig. 5 is a kind of interface schematic diagram of evidence obtaining setting provided in an embodiment of the present invention；

Fig. 6 is the flow diagram of another data processing method provided in an embodiment of the present invention；

Fig. 7 a is that the embodiment of the present invention provides a kind of interface schematic diagram of button；

Fig. 7 b is a kind of interface schematic diagram of APP evidence obtaining provided in an embodiment of the present invention；

Fig. 7 c is a kind of interface schematic diagram of APP evidence obtaining provided in an embodiment of the present invention；

Fig. 7 d is a kind of interface schematic diagram for storing video provided in an embodiment of the present invention；

Fig. 8 is a kind of structural schematic diagram of data processing equipment provided in an embodiment of the present invention；

Fig. 9 is a kind of structural schematic diagram of intelligent terminal provided in an embodiment of the present invention.

Specific embodiment

Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair Embodiment in bright, every other implementation obtained by those of ordinary skill in the art without making creative efforts Example, shall fall within the protection scope of the present invention.

The embodiment of the present invention, for how more effectively to collect evidence to web data, propose a kind of data processing method, Equipment and intelligent terminal are obtained by evidence obtaining browser client to during the evidence obtaining browser client loads webpage To data information be packaged, generate evidence packet, and evidence packet be sent to server and is stored.

In one embodiment, which can be applied to data processing equipment, and the data processing equipment can With setting in evidence obtaining browser client, in certain embodiments, the evidence obtaining browser client may be provided at intelligent end On end.In one embodiment, the evidence obtaining browser client is internet data evidence obtaining special browser, with Chromium Project is source code basis, has and high speed viewing experience compatible with the webpage that Chrome compares favourably, while possessing more extension sides To thus setting up good evidence obtaining Products Eco in internet abundant.It is described evidence obtaining browser client be brand-new design with Browser is main carriers, can when browsing webpage directly in inspection while facilitate seamlessly to illegal webpage carry out It collects evidence without the browser client for interrupting navigation process.The evidence obtaining browser client remains Chromium browser Nearly all browser function, have almost the same usage experience with the primary browser of Chromium.The evidence obtaining browser Client mainly includes address bar navigation, tag control, menu and setting.Or it can be to described when key operation after browser starting The local zone time of evidence obtaining browser client is proofreaded with specified time service equipment (such as Beidou dual-mode time service server), with amendment Local zone time, and the process and evidence obtaining time attribute of evidence obtaining generation evidence packet are demarcated.In certain embodiments, described to take Card browser client may operate under Windows operating system, as 7 operating system of Windows or Windows10 operate System.

The evidence obtaining browser client is the browser for integrating web page browsing, data extraction, solidifying, and passes through peace Full transmission is connect with server, realizes evidence management.The convenience rendered using browser kernel, is greatly retained to webpage The record of data, and rapid, seamless evidence obtaining is realized by high-efficient extraction technology, based on unified back-stage management channel, Ke Yishi Existing one-stop evidence management platform.The evidence obtaining browser client can solve big absolutely based on Chromium browser Most webpage compatibility, using the control to primary browser code, may be implemented web data and dramatically excavate, and mention Rise data reliability.The evidence obtaining browser client uses multi-tag mode, at any time to current net during web page browsing Page is collected evidence, and the viewing experience of high speed is provided.The evidence obtaining browser client is based on Chromium browser, originally Body has a variety of mode of extensions, including the extension of plug-in unit, network etc., thus will expand profuse Ecological Information.

In one embodiment, when detecting that evidence obtaining browser client is turned on, data processing equipment can be from finger Obtain clock information in fixed time service equipment, and by the local zone time of the evidence obtaining browser client with from the time service equipment In the clock information that gets synchronize processing.To the evidence obtaining browser client local zone time with from the time service It, can be with if data processing equipment gets evidence obtaining instruction after the clock information got in equipment synchronizes processing The target category of the evidence obtaining instruction is determined according to the user's operation for triggering the evidence obtaining instruction, and is instructed according to preset evidence obtaining Classification and evidence obtaining rule corresponding relationship, determining target evidence obtaining corresponding with the target category of the evidence obtaining instruction is regular, In, the classification of different evidence obtaining instructions corresponds to different evidence obtaining rules.The data processing equipment can take according to the target The page that card rule shows the evidence obtaining browser client is collected evidence, and is obtained aobvious with the evidence obtaining browser client The associated forensic data of the page shown, wherein the forensic data includes page screenshot and page associated data.The data The evidence obtaining browser client and the specified time service equipment progress time are same during the available evidence obtaining of processing equipment Step treated evidence obtaining temporal information, and is packaged the forensic data and the evidence obtaining temporal information, generation evidence packet, And the evidence packet is sent to server, it collects evidence so as to realize to web data, it is therefore prevented that web data quilt It distorts or deletes, improve the safety of web data and the validity as evidence.

Data processing method provided in an embodiment of the present invention is schematically illustrated with reference to the accompanying drawing.

Referring to Figure 1, Fig. 1 is a kind of structural schematic diagram of data processing system provided in an embodiment of the present invention, such as Fig. 1 institute Show, which includes: server 11 and evidence obtaining browser client 12.The evidence obtaining browser client 12 may be mounted at intelligence Data are handled in energy terminal.Browser client 12 collect evidence when detecting that evidence obtaining browser client is turned on, Can obtain clock information from specified time service equipment, and by the local zone time of the evidence obtaining browser client with from described The clock information got in time service equipment synchronizes processing.To it is described evidence obtaining browser client local zone time with from After the clock information got in the time service equipment synchronizes processing, taken if evidence obtaining browser client 12 is got Card instruction, then can according to trigger it is described evidence obtaining instruction user's operation determine it is described evidence obtaining instruction target category, and according to The classification of preset evidence obtaining instruction and the corresponding relationship of evidence obtaining rule, determining mesh corresponding with the target category of the evidence obtaining instruction Mark evidence obtaining rule, wherein the classification of different evidence obtaining instructions corresponds to different evidence obtaining rules.Collecting evidence browser client 12 can be with It is collected evidence, and obtained and the evidence obtaining according to the page that target evidence obtaining rule shows the evidence obtaining browser client The associated forensic data of the page that browser client is shown, wherein the forensic data includes that page screenshot and the page close Join data.The evidence obtaining browser client is awarded with described specified during the evidence obtaining available evidence obtaining of browser client 12 When equipment carry out time synchronizing after evidence obtaining temporal information, and to the forensic data and the evidence obtaining temporal information progress Encapsulation generates evidence packet, is sent to server 11 from by the evidence packet.

Fig. 2 is referred to, Fig. 2 is a kind of schematic flow diagram of data processing method provided in an embodiment of the present invention, such as Fig. 2 institute Show, this method can include:

S201: when detecting that evidence obtaining browser client is turned on, obtaining clock information from specified time service equipment, And the local zone time of the evidence obtaining browser client is synchronized with the clock information got from the time service equipment Processing.

In the embodiment of the present invention, when detecting that evidence obtaining browser client is turned on, data processing equipment can be from finger Obtain clock information in fixed time service equipment, and by the local zone time of the evidence obtaining browser client with from the time service equipment In the clock information that gets synchronize processing.In certain embodiments, the specified time service equipment can be double for Beidou Mould time service server.By to evidence obtaining browser client carry out time synchronizing, can ensure evidence obtaining, evidence it is true Property.

In one embodiment, the evidence obtaining browser client includes clock display region, evidence obtaining button, APP evidence obtaining Button, record screen button, management button of collecting evidence, evidence obtaining setting button, batch evidence obtaining button；Wherein, the clock display region is used After showing the evidence obtaining browser client and synchronizing processing from the clock information got in the time service equipment Temporal information.

It can be specifically illustrated by taking Fig. 3 a, Fig. 3 b, Fig. 3 c as an example, Fig. 3 a is a kind of login circle provided in an embodiment of the present invention Face schematic diagram, Fig. 3 b are a kind of time synchronization interface schematic diagrams provided in an embodiment of the present invention, and Fig. 3 c is that the embodiment of the present invention mentions Interface schematic diagram after a kind of time synchronization supplied.When by installation procedure successfully install the evidence obtaining browser client it Afterwards, export browser interface 31 as shown in Figure 3a, include beginning to use button 311 on the browser interface 31, when with When beginning to use button 311 described in the click of family, the evidence obtaining browser client can be opened.When detecting evidence obtaining browsing When device client is turned on, the evidence obtaining browser client can export prompting interface 312 shown in Fig. 3 b, prompt circle Face 312 is for prompting the user whether that opening Beidou time service synchronizes, if detecting that user clicks in the prompting interface 312 really Determine button 313, then data processing equipment can obtain clock information from specified time service equipment (such as Beidou time service server), And the local zone time of the evidence obtaining browser client is synchronized with the clock information got from the time service equipment Processing, and after the output of clock display region 314 on the interface of the evidence obtaining browser client as shown in Figure 3c synchronizes Clock information.

S202: in the local zone time to the evidence obtaining browser client and the clock got from the time service equipment After information synchronizes processing, if getting evidence obtaining instruction, determined according to the user's operation for triggering the evidence obtaining instruction It is described evidence obtaining instruction target category, and according to it is preset evidence obtaining instruction classification and evidence obtaining rule corresponding relationship, determine with The corresponding target evidence obtaining rule of the target category of the evidence obtaining instruction.

In the embodiment of the present invention, obtained in the local zone time to the evidence obtaining browser client with from the time service equipment It, can be according to triggering if data processing equipment gets evidence obtaining instruction after the clock information got synchronizes processing It is described evidence obtaining instruction user's operation determine it is described evidence obtaining instruction target category, and according to it is preset evidence obtaining instruction classification with The corresponding relationship for rule of collecting evidence, determining target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, in certain implementations In example, the classification of different evidence obtaining instructions corresponds to different evidence obtaining rules.

In one embodiment, data processing equipment can detecte the evidence obtaining browser when getting evidence obtaining instruction Whether client logs in, if detecting that the evidence obtaining browser client is not logged on, when detect arbitrarily with evidence obtaining phase The user's operation of pass can trigger the evidence obtaining browser client output login interface, and the identity for obtaining user's input is recognized Information is demonstrate,proved, to verify to the authentication information, if be proved to be successful, can permit execution evidence obtaining operation.At certain In a little embodiments, the user's operation relevant to evidence obtaining can be the point of the clicking operation of evidence obtaining button, batch evidence obtaining button Hit operation, APP evidence obtaining button clicking operation etc. in any one user's operation for evidence obtaining, the embodiment of the present invention pair with Relevant user's operation of collecting evidence is not specifically limited.In certain embodiments, the authentication information may include account and Password, the account can be number, text, picture, fingerprint, any one or more in voice, and the cipher leaf can be Number, text, picture, fingerprint, any one or more in voice.

It in some embodiments, include login button in the user interface of the evidence obtaining browser client, if detection It is not logged on to the evidence obtaining browser client, then user can click in the user interface of the evidence obtaining browser client Login button, to export login interface, and obtain user input authentication information, with to the authentication information into Row verifying can permit execution evidence obtaining operation if be proved to be successful.

It can be specifically illustrated by taking Fig. 4 a and 4b as an example, Fig. 4 a is the boundary that a kind of user provided in an embodiment of the present invention logs in Face schematic diagram, Fig. 4 b are the interface schematic diagrams that another user provided in an embodiment of the present invention logs in.Data processing equipment is obtaining When getting evidence obtaining instruction, it can detecte whether the evidence obtaining browser client logs in, if detecting the evidence obtaining browser Client is not logged on, then can click login button 401 as shown in fig. 4 a, if not logged in success, then output is as schemed It prompting interface 402 shown in 4a can be defeated if detecting the clicking operation in the prompting interface 402 to login button Login interface 403 as shown in Figure 4 b out, user can input account and password on login interface 403, to the account It is verified with password, if be proved to be successful, can permit execution evidence obtaining operation.

S203: collecting evidence according to the page that target evidence obtaining rule shows the evidence obtaining browser client, and Obtain forensic data associated with the page that the evidence obtaining browser client is shown.

In the embodiment of the present invention, data processing equipment can collect evidence rule to the evidence obtaining browser visitor according to the target The page that family end is shown is collected evidence, and obtains evidence obtaining number associated with the page that the evidence obtaining browser client is shown According to.In certain embodiments, the forensic data includes page screenshot and page associated data.

In one embodiment, the data processing equipment is regular to the evidence obtaining browser according to target evidence obtaining Before the page that client is shown is collected evidence, evidence obtaining setting can be carried out.It include evidence obtaining on the evidence obtaining browser client Button or evidence obtaining setting button is arranged can be got by the right button of any position of the browser client page. It, can be to the evidence obtaining browser client when data processing equipment gets clicking operation of the user to evidence obtaining setting button Carry out user setting, the setting of evidence obtaining function, record screen setting etc..

It is illustrated by taking Fig. 5 as an example, Fig. 5 is a kind of interface schematic diagram of evidence obtaining setting provided in an embodiment of the present invention, such as Data processing equipment described in fruit detects that user to the clicking operation of evidence obtaining setting button 501, then can export evidence obtaining setting circle Face 502, to carry out evidence obtaining setting, function setting, record screen setting etc. in the evidence obtaining set interface 502.

S204: it is same that the evidence obtaining browser client and the specified time service equipment progress time during collecting evidence are obtained Step treated evidence obtaining temporal information, and is packaged the forensic data and the evidence obtaining temporal information, generation evidence packet, And the evidence packet is sent to server.

In the embodiment of the present invention, the evidence obtaining browser client and institute during the available evidence obtaining of data processing equipment It states specified time service equipment and carries out the evidence obtaining temporal information after time synchronizing, and when to the forensic data and the evidence obtaining Between information be packaged, generate evidence packet, and the evidence packet be sent to server.

In one embodiment, the data processing equipment is to the forensic data and evidence obtaining temporal information progress When encapsulation, the forensic data and the evidence obtaining temporal information can also be encrypted, to ensure the safety of evidence packet.

In the embodiment of the present invention, data processing equipment can by the local zone time of the evidence obtaining browser client with from institute It states the clock information got in time service equipment and synchronizes processing, and when getting evidence obtaining instruction, taken according to triggering The user's operation of card instruction determines the target category of the evidence obtaining instruction, and classification and evidence obtaining according to preset evidence obtaining instruction The corresponding relationship of rule, determining target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, thus according to the mesh The page that mark evidence obtaining rule shows the evidence obtaining browser client is collected evidence, to obtain and the evidence obtaining browser clients Hold the associated forensic data of the page of display.The data processing equipment can be by the forensic data and the evidence obtaining Temporal information is packaged, and generates evidence packet, and the evidence packet is sent to server.It may be implemented in this way pair Web data is collected evidence, and web data is prevented to be tampered or delete, and improves the safety of web data and as evidence Validity.

Referring to Fig. 6, Fig. 6 is the flow diagram of another data processing method provided in an embodiment of the present invention, wherein The difference of data processing method described in Fig. 6 and Fig. 2 data processing method being described is that the embodiment of the present invention is Detailed description to evidence obtaining process.Data processing method shown in fig. 6 may comprise steps of:

S601: when detecting that evidence obtaining browser client is turned on, obtaining clock information from specified time service equipment, And the local zone time of the evidence obtaining browser client is synchronized with the clock information got from the time service equipment Processing.

In the embodiment of the present invention, when detecting that evidence obtaining browser client is turned on, data processing equipment can be from finger Obtain clock information in fixed time service equipment, and by the local zone time of the evidence obtaining browser client with from the time service equipment In the clock information that gets synchronize processing, specific embodiment is as previously mentioned, details are not described herein again.

S602: according to the clicking operation to button of collecting evidence on evidence obtaining browser client got, obtaining evidence obtaining instruction, And determine the target category of the evidence obtaining instruction.

In the embodiment of the present invention, data processing equipment can according to get to evidence obtaining on evidence obtaining browser client by The clicking operation of button obtains evidence obtaining instruction, and determines the target category of the evidence obtaining instruction.

In one embodiment, the evidence obtaining browser client includes evidence obtaining button, to the evidence obtaining browser visitor The local zone time at family end with synchronize processing from the clock information got in the time service equipment after, data processing equipment Available user and takes the clicking operation of evidence obtaining button according on the evidence obtaining browser client got to described The clicking operation of button is demonstrate,proved, triggering obtains evidence obtaining instruction corresponding with the evidence obtaining button, and determination is instructed with the evidence obtaining Corresponding target category.

In one embodiment, the evidence obtaining browser client includes APP evidence obtaining button, to the evidence obtaining browser The local zone time of client with synchronize processing from the clock information got in the time service equipment after, data processing is set To the clicking operation of APP evidence obtaining button on the standby available evidence obtaining browser client, and according to the institute got It states on evidence obtaining browser client to the clicking operation of APP evidence obtaining button, exports and wrapped in the evidence obtaining browser client At least one APP included.The data processing equipment can determine the target APP of evidence obtaining according to the selection operation of user, and obtain Evidence obtaining instruction corresponding with the target APP is got, and determines target category corresponding with the evidence obtaining instruction.

In one embodiment, the evidence obtaining browser client includes batch evidence obtaining button, is browsed to the evidence obtaining The local zone time of device client with synchronize processing from the clock information got in the time service equipment after, data processing To the clicking operation of batch evidence obtaining button on the available evidence obtaining browser client of equipment, and according to getting To the clicking operation of batch evidence obtaining button on the evidence obtaining browser client, triggering is obtained and batch evidence obtaining button Corresponding evidence obtaining instruction, to determine target category corresponding with the evidence obtaining instruction.

S603: determining to be instructed with the evidence obtaining according to the corresponding relationship of the classification of preset evidence obtaining instruction and evidence obtaining rule Target category corresponding target evidence obtaining rule.

In the embodiment of the present invention, data processing equipment can be according to the classification of preset evidence obtaining instruction and pair of evidence obtaining rule It should be related to, determining target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, wherein the class of different evidence obtaining instructions Different evidence obtaining rules is not corresponded to.

S604: collecting evidence according to the page that target evidence obtaining rule shows the evidence obtaining browser client, with Obtain forensic data associated with the page that the evidence obtaining browser client is shown.

In the embodiment of the present invention, data processing equipment can collect evidence rule to the evidence obtaining browser visitor according to the target The page that family end is shown is collected evidence, with acquisition evidence obtaining number associated with the page that the evidence obtaining browser client is shown According to.

In one embodiment, if target evidence obtaining rule is determined according to the clicking operation to evidence obtaining button, Then data processing equipment can respond evidence obtaining instruction corresponding with the evidence obtaining button, current to the evidence obtaining browser client The shown page carries out screenshot, obtains first page screenshot, and obtain currently displayed with the evidence obtaining browser client The associated first page associated data of the page.In certain embodiments, the first page associated data is taken from described Card browser client receives web page interlinkage request and starts data acquired in the period terminated to the load of institute's requested webpage Information.

Specifically can be by taking Fig. 7 a as an example, Fig. 7 a is that the embodiment of the present invention provides a kind of interface schematic diagram of button, if described Target evidence obtaining rule be according to evidence obtaining button 702 clicking operation determination, then data processing equipment can respond with it is described The corresponding evidence obtaining of button 702 of collecting evidence instructs, and the page currently displayed to the evidence obtaining browser client carries out screenshot, obtains First page screenshot, and obtain first page associated with the currently displayed page of the evidence obtaining browser client and be associated with Data.

In one embodiment, if target evidence obtaining rule is determined according to the clicking operation to APP evidence obtaining button , then data processing equipment can respond evidence obtaining instruction corresponding with the target APP, to the evidence obtaining browser client The target APP currently displayed page carries out screenshot, obtains second page screenshot, and obtain and currently show with the target APP The associated second page associated data of the page shown.In certain embodiments, the second page associated data is from described Evidence obtaining browser client receives the target APP web page interlinkage request and starts the period terminated to the load of institute's requested webpage Acquired data information.

It can be specifically illustrated in conjunction with Fig. 7 a, Fig. 7 b, Fig. 7 c, Fig. 7 b is that a kind of APP provided in an embodiment of the present invention takes The interface schematic diagram of card, Fig. 7 c are a kind of interface schematic diagrams of APP evidence obtaining provided in an embodiment of the present invention.If at the data Reason equipment gets user to the clicking operation of the evidence obtaining button 701 of APP shown in Fig. 7 a, then can export boundary as shown in Figure 7b Face.If the data processing equipment gets the clicking operation of the APP704 in Fig. 7 b, boundary shown in Fig. 7 c can be exported Face, and evidence obtaining instruction corresponding with the APP704 is responded, the page currently displayed to Fig. 7 c carries out screenshot, obtains second page Face screenshot, and obtain second page associated data associated with the currently displayed page of Fig. 7 c.

In one embodiment, if target evidence obtaining rule is determined according to the clicking operation to batch evidence obtaining button , then data processing equipment can respond evidence obtaining corresponding with batch evidence obtaining button and instruct, to the evidence obtaining browser visitor The shown page carries out screenshot in preset time range at family end, obtains third page screenshot, and obtain with it is described collect evidence it is clear Look at the device client shown associated third page associated data of the page in preset time range.In some embodiments In, the third page associated data is from the evidence obtaining browser client acquired data letter in preset time range Breath.

By taking Fig. 7 a as an example, if target evidence obtaining rule is determined according to the clicking operation to batch evidence obtaining button 704 , then data processing equipment can respond evidence obtaining corresponding with batch evidence obtaining button 704 and instruct, to the evidence obtaining browser The shown page carries out screenshot to client in preset time range, obtains third page screenshot, and obtain and the evidence obtaining The browser client shown associated third page associated data of the page in preset time range.

In one embodiment, the evidence obtaining browser client includes record screen button, if the data processing equipment It detects the clicking operation on the evidence obtaining browser client to record screen button, then can be obtained from specified time service equipment Clock information, and by the local zone time of the evidence obtaining browser client and the clock information that gets from the time service equipment Synchronize processing.In the local zone time to the evidence obtaining browser client and the clock got from the time service equipment After information synchronizes processing, the data processing equipment can record the evidence obtaining browser client according to preset duration The video of the shown page or the view for recording the user interface displayed content of equipment where browser client of collecting evidence Frequently, and by the video of recording it is stored in local memory device.

Specifically can be by taking Fig. 7 a and Fig. 7 d as an example, Fig. 7 d is a kind of interface signal for storing video provided in an embodiment of the present invention Figure.If detecting the clicking operation for shielding button 703 on the evidence obtaining browser client to record shown in Fig. 7 a, at data Reason equipment can obtain clock information from specified time service equipment, and by the local zone time of the evidence obtaining browser client with The clock information got from the time service equipment synchronizes processing.At the local to the evidence obtaining browser client Between with synchronize processing from the clock information got in the time service equipment after, the data processing equipment can basis Preset duration records the video of the page shown by the evidence obtaining browser client, and at the end of recording, exports such as Fig. 7 d institute The storage interface shown, and the selected store path in interface is stored shown in Fig. 7 d according to user, the video of recording is deposited Storage.

S605: it is same that the evidence obtaining browser client and the specified time service equipment progress time during collecting evidence are obtained Step treated evidence obtaining temporal information, and is packaged the forensic data and the evidence obtaining temporal information, generation evidence packet, The evidence packet is sent to server.

In the embodiment of the present invention, the evidence obtaining browser client and institute during the available evidence obtaining of data processing equipment It states specified time service equipment and carries out the evidence obtaining temporal information after time synchronizing, and when to the forensic data and the evidence obtaining Between information be packaged, generate evidence packet, the evidence packet is sent to server.

In one embodiment, data processing equipment takes to the page shown by the evidence obtaining browser client When card, can detecte whether opened in the evidence obtaining browser client evidence obtaining record screen function, if testing result be it is yes, can With the recorded video when collecting evidence to the page shown by the evidence obtaining browser client, and to the forensic data, institute The video for stating evidence obtaining temporal information and recording is packaged, and generates evidence packet.

In one embodiment, it is clear can be stored in the evidence obtaining by the data processing equipment for the evidence packet that evidence obtaining obtains It lookes in device client, so that user can check the data packet of evidence obtaining at any time.

Referring to Fig. 8, Fig. 8 is a kind of structural schematic diagram of data processing equipment provided in an embodiment of the present invention, shown in Fig. 8 Equipment can be set in intelligent terminal, which can be smart phone, tablet computer, intelligent wearable device etc. Equipment.Wherein, data processing equipment shown in Fig. 8 may include synchronization unit 801, determination unit 802, evidence obtaining unit 803, hair Send unit 804.

Synchronization unit 801, for being obtained from specified time service equipment when detecting that evidence obtaining browser client is turned on Clock information is taken, and the local zone time of the evidence obtaining browser client is believed with the clock got from the time service equipment Breath synchronizes processing；

Determination unit 802, in the local zone time to the evidence obtaining browser client and from the time service equipment After the clock information got synchronizes processing, if getting evidence obtaining instruction, according to the triggering evidence obtaining instruction User's operation determines the target category of the evidence obtaining instruction, and corresponding with evidence obtaining rule according to the classification of preset evidence obtaining instruction Relationship, determining target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, wherein the classification of different evidence obtaining instructions Corresponding different evidence obtaining rule；

Evidence obtaining unit 803, the page for being shown according to target evidence obtaining rule to the evidence obtaining browser client It collects evidence, and obtains forensic data associated with the page that the evidence obtaining browser client is shown, wherein the evidence obtaining Data include page screenshot and page associated data；

Transmission unit 804 is set for the evidence obtaining browser client during obtaining evidence obtaining with the specified time service The standby evidence obtaining temporal information carried out after time synchronizing, and the forensic data and the evidence obtaining temporal information are sealed Dress generates evidence packet, and the evidence packet is sent to server.

Further, the evidence obtaining browser client includes that clock display region, evidence obtaining button, application APP take Demonstrate,prove button, record screen button, management button of collecting evidence, evidence obtaining setting button, batch evidence obtaining button；

Wherein, the clock display region is for showing that the evidence obtaining browser client is obtained with from the time service equipment The clock information got synchronizes the temporal information after processing.

Further, the evidence obtaining browser client includes evidence obtaining button；The determination unit 802 is according to triggering When the user's operation of evidence obtaining instruction determines the target category of the evidence obtaining instruction, it is specifically used for:

It obtains on the evidence obtaining browser client to the clicking operation of the evidence obtaining button；

According on the evidence obtaining browser client got to it is described evidence obtaining button clicking operation, triggering obtain with The corresponding evidence obtaining instruction of the evidence obtaining button, and determine target category corresponding with the evidence obtaining instruction；

The determination unit 802 according to target evidence obtaining rule to the page that shows of evidence obtaining browser client into When going and collect evidence, and obtaining forensic data associated with the page that the evidence obtaining browser client is shown, it is specifically used for:

Evidence obtaining instruction corresponding with the evidence obtaining button is responded, the page currently displayed to the evidence obtaining browser client Face carries out screenshot, obtains first page screenshot；

Obtain first page associated data associated with the currently displayed page of the evidence obtaining browser client, institute Stating first page associated data is since the evidence obtaining browser client receives web page interlinkage request to institute's requested webpage Load data information acquired in the period terminated.

Further, the evidence obtaining browser client includes APP evidence obtaining button；The determination unit 802 is according to triggering When the user's operation of the evidence obtaining instruction determines the target category of the evidence obtaining instruction, it is specifically used for:

Obtain the clicking operation on the evidence obtaining browser client to APP evidence obtaining button；

According on the evidence obtaining browser client got to the APP evidence obtaining button clicking operation, export institute State at least one APP for including in evidence obtaining browser client；

The target APP of evidence obtaining is determined according to the selection operation of user, and is got evidence obtaining corresponding with the target APP and referred to It enables, and determines target category corresponding with the evidence obtaining instruction；

Evidence obtaining instruction corresponding with the target APP is responded, to the current institute of target APP of the evidence obtaining browser client The page of display carries out screenshot, obtains second page screenshot；

Obtain second page associated data associated with the currently displayed page of the target APP, the second page Face associated data is since the evidence obtaining browser client receives the target APP web page interlinkage request to requested net Data information acquired in the period that page load terminates.

Further, the evidence obtaining browser client includes batch evidence obtaining button；The determination unit 802 is according to triggering When the user's operation of the evidence obtaining instruction determines the target category of the evidence obtaining instruction, it is specifically used for:

Obtain the clicking operation on the evidence obtaining browser client to batch evidence obtaining button；

According to, to the clicking operation of batch evidence obtaining button, triggering obtains on the evidence obtaining browser client got It takes evidence obtaining corresponding with batch evidence obtaining button to instruct, and determines target category corresponding with the evidence obtaining instruction；

Response evidence obtaining corresponding with batch evidence obtaining button instructs, to the evidence obtaining browser client in preset time The shown page carries out screenshot in range, obtains third page screenshot；

Obtain with the evidence obtaining browser client in preset time range shown by the associated third page of the page Face associated data, the third page associated data are acquired in preset time range from the evidence obtaining browser client Data information.

Further, the evidence obtaining unit 803, is also used to:

When collecting evidence to the page shown by the evidence obtaining browser client, the evidence obtaining browser clients are detected Whether evidence obtaining record screen function is opened in end；

If testing result is yes, the recording when collecting evidence to the page shown by the evidence obtaining browser client Video, and the video of the forensic data, the evidence obtaining temporal information and recording is packaged, generate evidence packet.

Further, the evidence obtaining browser client includes record screen button, and the equipment further includes record screen unit 805, Unit 805 is shielded in the record, is used for:

If detecting the clicking operation on the evidence obtaining browser client to record screen button, set from specified time service Standby middle acquisition clock information, and by the local zone time of the evidence obtaining browser client with got from the time service equipment Clock information synchronizes processing；

In the local zone time to the evidence obtaining browser client and the clock information got from the time service equipment After synchronizing processing, video or the recording of the page shown by browser client of collecting evidence are recorded according to preset duration The video of the user interface displayed content of equipment where the evidence obtaining browser client, and the video of recording is stored in this Ground stores in equipment.

Fig. 9 is referred to, Fig. 9 is a kind of structural schematic diagram of intelligent terminal provided in an embodiment of the present invention.As shown in the figure Server in the present embodiment may include: one or more processors 901；One or more input equipments 902, one or more A output equipment 903 and memory 904.Above-mentioned processor 901, input equipment 902, output equipment 903 and memory 904 pass through Bus 905 connects.For memory 904 for storing computer program, the computer program includes program instruction, processor 901 For executing the program instruction of the storage of memory 904.Wherein, processor 901 is configured for calling and store in memory 504 Program code, for performing the following operations:

Further, the evidence obtaining browser client includes evidence obtaining button；Processor 901 refers to according to the evidence obtaining is triggered When the user's operation of order determines the target category of the evidence obtaining instruction, it is specifically used for:

The processor 901 is carried out according to the page that target evidence obtaining rule shows the evidence obtaining browser client When collecting evidence, and obtaining forensic data associated with the page that the evidence obtaining browser client is shown, it is specifically used for:

Further, the evidence obtaining browser client includes APP evidence obtaining button；Processor 901 takes according to triggering When the user's operation of card instruction determines the target category of the evidence obtaining instruction, it is specifically used for:

Further, the evidence obtaining browser client includes batch evidence obtaining button；Processor 501 takes according to triggering When the user's operation of card instruction determines the target category of the evidence obtaining instruction, it is specifically used for:

The processor 501 is carried out according to the page that target evidence obtaining rule shows the evidence obtaining browser client When collecting evidence, and obtaining forensic data associated with the page that the evidence obtaining browser client is shown, it is specifically used for:

Further, processor 901 is also used to:

Further, the evidence obtaining browser client includes record screen button, and the processor 901 is also used to:

It should be appreciated that in embodiments of the present invention, alleged processor 901 can be central processing unit (Central Processing Unit, CPU), which can also be other general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic Device, discrete gate or transistor logic, discrete hardware components etc..General processor can be microprocessor or this at Reason device is also possible to any conventional processor etc..

Input equipment 902 may include Trackpad, microphone etc., output equipment 903 may include display (LCD etc.), Loudspeaker etc..

The memory 904 may include read-only memory and random access memory, and to processor 901 provide instruction and Data.The a part of of memory 904 can also include nonvolatile RAM.For example, memory 904 can also be deposited Store up the information of device type.

In the specific implementation, processor 901 described in the embodiment of the present invention, input equipment 902, output equipment 903 can Implementation described in embodiment described in embodiment described in Fig. 2 provided in an embodiment of the present invention and Fig. 6 is executed, also can be performed The implementation of server described in the embodiment of the present invention, details are not described herein.

A kind of computer readable storage medium, the computer-readable storage medium are additionally provided in an embodiment of the present invention Matter is stored with computer program, realizes when the computer program is executed by processor such as institute in Fig. 2 or embodiment as described in Figure 6 The implementation of server described in the embodiment of the present invention also can be performed in the implementation of description, and details are not described herein.

The computer readable storage medium can be the internal storage unit of server described in aforementioned any embodiment, Such as the hard disk or memory of server.The external storage that the computer readable storage medium is also possible to the server is set Plug-in type hard disk that is standby, such as being equipped on the server, intelligent memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card, flash card (Flash Card) etc..Further, the computer readable storage medium is also Can both including the server internal storage unit and also including External memory equipment.The computer readable storage medium is used Other programs and data needed for storing the computer program and the server.The computer readable storage medium It can be also used for temporarily storing the data that has exported or will export.

The above description is merely a specific embodiment, but scope of protection of the present invention is not limited thereto, any Those familiar with the art in the technical scope disclosed by the present invention, can readily occur in various equivalent modifications or replace It changes, these modifications or substitutions should be covered by the protection scope of the present invention.Therefore, protection scope of the present invention should be with right It is required that protection scope subject to.

Claims

1. a kind of data processing method characterized by comprising

When detecting that evidence obtaining browser client is turned on, clock information is obtained from specified time service equipment, and will be described The local zone time of evidence obtaining browser client synchronizes processing with the clock information got from the time service equipment；

It is carried out in the local zone time to the evidence obtaining browser client with the clock information got from the time service equipment After synchronization process, if getting evidence obtaining instruction, the evidence obtaining is determined according to the user's operation for triggering the evidence obtaining instruction The target category of instruction, and the corresponding relationship of the classification and evidence obtaining rule instructed according to preset evidence obtaining, the determining and evidence obtaining The corresponding target evidence obtaining rule of the target category of instruction, wherein the classification of different evidence obtaining instructions corresponds to different evidence obtaining rules；

Collected evidence according to target evidence obtaining rule to the page that show of evidence obtaining browser client, and acquisition with it is described The associated forensic data of the page that evidence obtaining browser client is shown, wherein the forensic data includes page screenshot and page Face associated data；

It obtains during collecting evidence after collect evidence browser client and the specified time service equipment progress time synchronizing Evidence obtaining temporal information, and the forensic data and the evidence obtaining temporal information are packaged, generate evidence packet, and by institute It states evidence packet and is sent to server.

2. the method according to claim 1, wherein

The evidence obtaining browser client includes clock display region, evidence obtaining button, application APP evidence obtaining button, records to shield and press Button, evidence obtaining management button, evidence obtaining setting button, button of collecting evidence in batches；

Wherein, the clock display region is for showing that the evidence obtaining browser client is got with from the time service equipment Clock information synchronize processing after temporal information.

3. according to the method described in claim 2, it is characterized in that, the evidence obtaining browser client includes evidence obtaining button；Institute State the target category that the evidence obtaining instruction is determined according to the user's operation for triggering the evidence obtaining instruction, comprising:

According on the evidence obtaining browser client got to it is described evidence obtaining button clicking operation, triggering obtain with it is described The corresponding evidence obtaining instruction of button of collecting evidence, and determine target category corresponding with the evidence obtaining instruction；

It is described to be collected evidence according to target evidence obtaining rule to the page that show of evidence obtaining browser client, and obtain and The associated forensic data of the page that the evidence obtaining browser client is shown, comprising:

Corresponding with evidence obtaining button evidence obtaining is responded to instruct, to it is described collect evidence the currently displayed page of browser client into Row screenshot obtains first page screenshot；

Obtain the page associated first page associated data currently displayed with the browser client of collecting evidence, described the One page associated data is to load since the evidence obtaining browser client receives web page interlinkage request to institute's requested webpage Data information acquired in the period of end.

4. according to the method described in claim 2, it is characterized in that, the evidence obtaining browser client includes APP evidence obtaining button； The target category that the evidence obtaining instruction is determined according to the user's operation for triggering the evidence obtaining instruction, comprising:

According to, to the clicking operation of APP evidence obtaining button, being taken described in output on the evidence obtaining browser client got At least one APP for including in card browser client；

The target APP of evidence obtaining is determined according to the selection operation of user, and gets evidence obtaining instruction corresponding with the target APP, And determine target category corresponding with the evidence obtaining instruction；

Evidence obtaining instruction corresponding with the target APP is responded, it is currently displayed to the target APP of the evidence obtaining browser client The page carry out screenshot, obtain second page screenshot；

Second page associated data associated with the currently displayed page of the target APP is obtained, the second page is closed Connection data are to add since the evidence obtaining browser client receives the target APP web page interlinkage request to institute's requested webpage Carry data information acquired in the period terminated.

5. according to the method described in claim 2, it is characterized in that, the evidence obtaining browser client includes that batch evidence obtaining is pressed Button；The target category that the evidence obtaining instruction is determined according to the user's operation for triggering the evidence obtaining instruction, comprising:

According on the evidence obtaining browser client got to the batch evidence obtaining button clicking operation, triggering obtain with The corresponding evidence obtaining instruction of batch evidence obtaining button, and determination target category corresponding with the evidence obtaining instruction；

Response evidence obtaining corresponding with batch evidence obtaining button instructs, to the evidence obtaining browser client in preset time range The interior shown page carries out screenshot, obtains third page screenshot；

It obtains and the evidence obtaining browser client associated third page pass of the shown page in preset time range Join data, the third page associated data is from the evidence obtaining browser client acquired number in preset time range It is believed that breath.

6. according to the described in any item methods of claim 3-5, which is characterized in that the method also includes:

When collecting evidence to the page shown by the evidence obtaining browser client, detect in the evidence obtaining browser client Whether function is shielded in unlatching evidence obtaining record；

If testing result is yes, the recording view when collecting evidence to the page shown by the evidence obtaining browser client Frequently, and to the video of the forensic data, the evidence obtaining temporal information and recording it is packaged, generates evidence packet.

7. the method according to claim 1, wherein the evidence obtaining browser client includes record screen button, institute State method further include:

If the clicking operation on the evidence obtaining browser client to record screen button is detected, from specified time service equipment Obtain clock information, and by the local zone time of the evidence obtaining browser client and the clock that gets from the time service equipment Information synchronizes processing；

It is carried out in the local zone time to the evidence obtaining browser client with the clock information got from the time service equipment After synchronization process, according to preset duration record it is described evidence obtaining browser client shown by the page video or recording described in The video of the user interface displayed content for browser client place equipment of collecting evidence, and the video of recording is stored in local deposit It stores up in equipment.

8. a kind of data processing equipment characterized by comprising

Synchronization unit, for obtaining clock from specified time service equipment when detecting that evidence obtaining browser client is turned on Information, and the local zone time of the evidence obtaining browser client is carried out with the clock information got from the time service equipment Synchronization process；

Determination unit, for the evidence obtaining browser client local zone time with get from the time service equipment After clock information synchronizes processing, if getting evidence obtaining instruction, according to the user's operation for triggering the evidence obtaining instruction Determine the target category of the evidence obtaining instruction, and according to the corresponding relationship of the classification of preset evidence obtaining instruction and evidence obtaining rule, really Fixed target evidence obtaining rule corresponding with the target category of the evidence obtaining instruction, wherein the classification of different evidence obtaining instructions is corresponding not Same evidence obtaining rule；

Evidence obtaining unit, the page for being shown according to target evidence obtaining rule to the evidence obtaining browser client take Card, and obtain forensic data associated with the page that the evidence obtaining browser client is shown, wherein the forensic data packet Include page screenshot and page associated data；

Transmission unit, for when obtaining that the evidence obtaining browser client and the specified time service equipment carry out during evidence obtaining Between evidence obtaining temporal information after synchronization process, and the forensic data and the evidence obtaining temporal information are packaged, generate card Server is sent to according to packet, and by the evidence packet.

9. a kind of intelligent terminal, which is characterized in that including processor, input equipment, output equipment and memory, the processing Device, input equipment, output equipment and memory are connected with each other, wherein the memory is for storing computer program, the meter Calculation machine program includes program instruction, and the processor is configured for calling described program instruction, executes claim 1-7 such as and appoints Method described in one.

10. a kind of computer readable storage medium, which is characterized in that the computer storage medium is stored with computer program, The computer program includes program instruction, and described program instruction makes the processor execute such as right when being executed by a processor It is required that the described in any item methods of 1-7.