RU2320010C2 - Device for examining electronic pocket books - Google Patents

Abstract

FIELD: forensic examination of electronic information carriers and, in particular, technology for accessing password-protected information, contained in electronic pocket-books.

SUBSTANCE: in accordance to the invention, code generation block generates a code series, which is injected into electronic pocket-book being examined. Visual control block receives and analyzes information from the screen of electronic pocket-book. Signal from visual control block is received at control block. If the signal from visual control block indicates a wrong password, control block outputs a command to code generation block to generate next code series. If the signal from visual control block indicates correct password, control block outputs a signal which is received by indication block.

EFFECT: possible automation of selection of password for accessing information contained in electronic pocket-books which do not have external interface.

3 dwg

Description

The invention relates to forensics and forensics, and in particular to the use of electronic means to increase the efficiency and objectivity of conducting examinations and expert studies of electronic information carriers by automating a number of operations.

The proposed device allows with high reliability to quickly access the password-protected information stored in the memory received for the forensic examination of the electronic notebook (EZK), while the quantitative and qualitative characteristics of the EZK are not changed, which is crucial to ensure the validity of the results of the forensic procedure .

One of the types of forensic examination is a computer-technical examination. At this stage of development, computer-technical expertise is an independent type of forensic examination, belonging to the class of engineering-technical examinations and carried out in order to: determine the status of an object as a computer tool, identify and study its trace in the crime under investigation, and also gain access to computer information on data carriers, followed by a comprehensive study of it. These goals are represented by the generic tasks of the CHP [1].

When solving the problems of computer-technical expertise, it is often necessary to gain access to information contained in a password-protected area of electronic memory.

Known software and hardware and software for access to information locked with a password stored on a computer’s hard drives, in notebooks of mobile cellular communication terminals and in organizers:

- a hardware-software complex for access to information stored on PC-3000 hard drives [2];

- hardware and software complex for access to information stored in notebooks of Uni box mobile communication terminals [3];

- software package Encase [4] and others.

Currently, the task of accessing information protected by a password is solved by connecting the technical equipment under study using standard means of pairing to a device (usually a computer) that feeds code combinations to its input in order to select a password (brute force method).

However, in a number of EZK models (organizers) there is no external interface, which does not allow the use of standard means of pairing.

At the same time, the task of examining such EZKs is very acute and in some cases has important social results.

Since during the examinations it is not allowed to change the quantitative and qualitative characteristics of the investigated material evidence, EZK cannot be investigated using destructive methods, and therefore, it is not possible to extract memory chips to conduct research outside the composition of the EZK. Moreover, the microcircuits used in the EZK are custom-made (non-standard) and unpacked. Therefore, the only way remains - manual search.

The existing technology for accessing the information contained in the memory of the EZK consists in the formation of a set of codes, presumably a password, the sequential entry of these codes from the EZK keyboard and the visual control of the inscriptions displayed on the EZK screen. If the password does not match the entered code combination, an inscription of the type "PASSWORD INCORRECT. REPEAT ENTER" is displayed. After that, the following code combination is entered. If the password matches the entered code combination, an inscription is displayed that has the meaning "PASSWORD ACCEPTED". Indicated inscriptions in the first and second cases for different models of EZKs may differ in content (but not sense), language, etc. But in any case, the displayed inscriptions in the first and second cases differ from each other and are a priori known (contained in the technical description of the EZK, publicly available information).

The described technology for gaining access to information contained in the memory received for examination of the EZK has a number of significant drawbacks:

- manual enumeration is associated with the need for long-term involvement of an expert for unproductive (in terms of direct examination) work;

- the quality of manual operations is associated with operator fatigue, i.e. decreases over time;

- documenting the process is difficult.

An object of the invention is to provide automation of the process of selecting a code combination, which is a password.

The problem is solved in that a device is proposed, consisting of:

- code generation unit,

- interface unit,

- visual inspection unit,

- control unit,

- indication unit.

The code generation unit is designed to generate a sequence of code combinations that claim to be a password for accessing information stored in the EZK. It is a device that has a control input, a service output and n information outputs, where n is the number of buttons on the EZK keyboard. Based on the control signal supplied to the control input, the code generation unit generates a code combination, which is a sequence of non-overlapping time pulses at m (m≤n) information outputs. The sequence of control signals supplied to the control input leads to the formation of a sequence of different code combinations, the sequence of which is determined by the algorithm for generating code combinations or a dictionary of code combinations.

The algorithm for generating code combinations may implement any of the known methods for complete or truncated enumeration. Complete enumeration involves the formation of a sequence of code combinations containing all possible code combinations with a length of not more than the maximum password length in the studied EZK model. Truncated enumeration involves the formation of a sequence of code combinations containing all possible combinations under given restrictions, for example: the length of the combination, the composition of the characters used for the password, etc. A typical variant of truncated enumeration is the enumeration of various combinations of initials and the date of birth of the owner of the EZK.

The dictionary may contain an arbitrary number of specified code combinations.

The interface unit is designed to provide a physical connection of the information outputs of the code generation unit with the outputs of the EZK keyboard and the coordination of voltage levels. In the simplest case, the interface unit is a set of conductors connecting the information outputs of the code generation unit to the contact pads of the EZK keyboard without violating their integrity or to the contacts of the keyboard connector available on many EZK models.

The control unit is intended for generating control signals for the code generation unit. It is a device with two inputs and two outputs, performing the function of a pulse shaper, triggered by the input signals.

The visual control unit is designed to monitor the status of the EZK indicator and is a sensitive element that distinguishes between the intensity (brightness) of the glow or color (for example, a photodiode with a lens). He must distinguish between the states of the EZK indicator corresponding to the indication of messages about correct and incorrect password entry.

The display unit is designed to generate a signal (audio and / or light) about the end of the password selection process and is a device that generates an audio and / or light signal from a trigger signal received at its input from the output of the control unit.

The proposed solution can be applied to all types of EZKs, however, due to the fact that the problem is most difficult to solve in the field of EZKs without an interface, the practical solution is of particular importance in relation to EZK types:

Manufacturer Models Citizen ED-87PCL, ED-7200RX, ED-7600RX, ED-7700RX, ED-8700RX, ED-9000, ED-6200SP, EDT-6800, RX-2700II, RX-3200, RX-3400II, RX-4100, RX- 5000, RX-5500, RX-5640, RX-5740, RX-6600, RX-7000, RX-9600, RX-7000, MB-165RA, AX-1200, AX-200 Casio BN 10, BN 20, SF-3990, SF-4300 (A, B), SF-4600 (RS, B, C), SF-4900 (RS, B, C), SF-4980ER, SF-4985ER, SF -4990, SF-5580, SF-5780, SF-5800RS, SF-5980, SF-6990, SF-7100SY, SF-7200SY, SF-7990, SF-8000, SF-8350R, CSF-4450 (A), CSF-4650 (A), CSF-7950, DC-7500RS, DC-7800RS, DC-8500RS, DC-9500RS Sharp ZQ-150, ZQ-170, ZQ-M202R, ZQ-M402R, ZQ-470, ZQ-570, Language Teacher EGR 3300, EGR 5300T Ectaco ER-486T, ER-586T, ER-586HT, EGR-5300T, ER-2200T, ER-3000 Canon DM-2400CR, DM-2500CR Forum S-738

An embodiment of the device is shown in FIG. 1, where the following notation is introduced:

1 - interface unit

2 - block generating codes,

3 - block visual inspection,

4 - control unit

5 - display unit.

The information outputs (n outputs) of the code generation unit 2 are connected to the inputs of the interface unit 1, the service output of the code generation unit 2 is connected to the second input of the control unit 4, the output of the visual control unit 3 is connected to its first input, the first and second outputs of the control unit 4 are connected to the input of the display unit 5 and the code generation unit 2, respectively, the outputs of the interface unit 1 are intended to be connected to the electronic notebook under study, and the input of the visual control unit 3 is an optical element, when taking the image from the screen of the indicator of the investigated EZK.

The proposed device operates as follows.

After turning on the power of the EZK, the inscription "ENTER PASSWORD" is displayed on its screen. Manually from the EZK keyboard any code combination is entered. If it is a password (an unlikely event), then on the screen some inscription "A" is indicated, and the further expert examination procedure no longer requires a password; if the entered code combination is not a password, then on the screen some inscription “B” is indicated. The content and type of the inscriptions “A” and “B” for different types of EZKs may differ, but are known from the technical description (instructions) of the EZK, which is publicly available (can be found in the store or on the manufacturer’s website). The visual control unit 3 is located relative to the EZC screen in such a way that when the first inscription appears, the output signal is absent, and when the second one appears, it is present. Then the absence of a signal at the output of the visual control unit 3 after applying the code combination from the output of the code generation unit 2 through the interface unit 1 to the EZK will correspond to the achievement of the goal - access to the password-protected information stored in the EZK memory. Therefore, the absence of a signal at the output of the visual control unit 3 after applying the code combination from the output of the code generation unit 2 through the interface unit 1 to the EZC is a command for the control unit 4 to complete the code generation procedure.

The code generation unit 2 generates codes either by exhaustive search or by truncated exhaustive search, the restrictions of which may be: maximum or fixed length of the code combination, case, used symbols, dictionary enumeration can also be used.

The completion of the search procedure (stopping rules are: 1) reaching the end of the dictionary, 2) password selection) may be accompanied by a sound or light signal generated by the display unit 5 by the command of the control unit 4.

Figure 2 presents timing diagrams explaining the operation of the device, where u ₁ are the signals at the output 2 of the control unit 4, u ₂₁ -u _2n are signals at the information outputs of the code generation unit 2, u ₃ are signals at the service output of the code generation unit 2 , u ₄ - signals at the output of the visual control unit 3, u ₅ - signals at the output 1 of the control unit 4.

At time t ₁ corresponding to the start of operation of the device, an impulse is generated at the output 2 of control unit 4 (see graph u ₁ (t)), whose potential for code generation unit 2 is a command to start generating a code sequence. The code generation unit 2 generates a pulse sequence, which from its information outputs through the interface unit 1 is fed to the EPC and provides the procedure for dialing the first code combination (see graphs u ₂₁ (t) -u _2n (t)). The code sequence pulse arriving at the i-th output of the EZK keyboard from the i-th information output of the code generation unit 2 through the interface unit 1 is, in the information sense, equivalent to a single press of the corresponding i-th key of the EZK keyboard. For example, if the first information output of the code generation unit 2 is connected to via the interface unit 1 with the output of the EZK keyboard corresponding to the A key, then the pulse on the graph u ₂₁ (t) is equivalent to pressing the A key on the EZK keyboard. The last pulse of the code sequence (pulse "ENTER") corresponds to pressing the "ENTER" button on the keyboard of the EZK. As a result, the message “INCORRECT PASSWORD. REPEAT ENTER” appears on the EPC screen, as a result of which a signal is generated at the output of the visual control unit indicating a change in the indicator state in the controlled area (see graph u ₄ (t)). The trailing edge of the “ENTER” pulse at time t ₂ provides a short gating pulse at the service output of the code generation unit 2 (see graph u ₃ (t)), during which the control unit 4 analyzes the level of the signal received at its first input from the output of the visual control unit 3. A high level of the signal at the output of the visual control unit 3 leads to the formation at the time t ₃ at the output 2 of the control unit 4 pulses (see graphs u ₁ (t) and u ₄ (t)), which triggers the generation unit codes 2 to the formation of the following lnosti impulses which, through the interface block 1 is supplied to EZK procedure and provides the second set codeword. The procedure is repeated cyclically up until the time of existence sign of life pulse at the second output block generating code 2 is read from the output unit of visual control 3 low level signal (time t _4), whereby at the first output of the control unit 4 will be formed start signal of indication unit 5 (see graph u ₅ (t)), the change of state of which (inclusion of an audio and / or light signal) will indicate the completion of the password selection procedure.

The algorithm of the control unit is shown in figure 3.

The proposed device will provide a radical increase in the potential for examination:

- due to the automation of the search process increases the efficiency of the process;

- the expert’s search using a technical device ensures the interconnected operation of the elements of the technological chain and the possibility of documenting actions.

Literature

1. Zubakha B.C., Usov A.I., Saenko G.V., Volkov G.A., Bely S.L., Semikalenova A.I. General provisions on the designation and production of computer-technical expertise: Methodological recommendations. - M .: GU EKTS Ministry of Internal Affairs of Russia, 2000. - 65 p., 6 ill., Bibliographer., Adj.

2. www.dicom.ru

3. www.uni_box.ru

4. www.guidancesoftware.com

Claims (1)

A device for providing access to password-protected information contained in electronic notebooks (EZK), characterized in that it contains a pairing unit, the outputs of which are connected to the studied EZK, and the inputs to the information outputs of the code generation unit, from the service output of which to the second input of the unit the control unit receives a gating pulse, during which the control unit analyzes the signal received at its first input from the visual control unit, which contains an optical element receiving an image with EZK crane, while the control unit generates a pulse at the second output that enters the input of the code generation unit and is a command to generate a code sequence if the signal from the visual control unit indicates an incorrect password, and generates a signal at the first output that goes to the input of the display unit if the signal from the visual inspection unit indicates a valid password.

Images