WO2020249112A1

WO2020249112A1 - Method and system for digital evidence fixing and network forensics on basis of memory forensics and blockchain

Info

Publication number: WO2020249112A1
Application number: PCT/CN2020/095945
Authority: WO
Inventors: 王连海; 张淑慧
Original assignee: 山东省计算中心（国家超级计算济南中心）
Priority date: 2019-06-14
Filing date: 2020-06-12
Publication date: 2020-12-17
Also published as: CN110232645A; CN110232645B; AU2020290622A1

Abstract

A method and system for digital evidence fixing and network forensics on the basis of memory forensics and a blockchain. The method comprises: a digital evidence fixing terminal downloading a credible forensic tool by means of a blockchain network (S101); verifying the legitimacy of executable codes of the forensic tool (S102); running the forensic tool to obtain digital data, generating an operation log, acquiring computer memory information by using the memory forensics technique and performing evidence fixing (S103); generating a hash value and uploading the same to the blockchain network, and receiving a returned corresponding blockchain address (S104); sending the address to a judicial expertise unit terminal; the judicial expertise unit terminal receiving the blockchain address sent by the digital evidence fixing terminal (S201); querying to obtain information on the blockchain and verifying the legitimacy thereof (S202); analyzing the memory information by using the memory forensics technique, extracting a system state when the digital evidence is obtained and verifying the consistency thereof (S203); determining, by using the memory analysis, whether the forensic tool has been hooked or injected when running, and verifying the reliability of the operating environment thereof (S204); and generating a judicial expertise report (S205).

Description

Electronic evidence fixation and network evidence collection method and system based on internal deposit and withdrawal evidence and blockchain

Technical field

The present disclosure belongs to the technical field of electronic forensics, and relates to a method and system for electronic evidence fixation and network forensics based on internal memory forensics and blockchain.

Background technique

The statements in this section merely provide background information related to the present disclosure, and do not necessarily constitute prior art.

While modern information technology has brought convenience to people’s work and life, it has inevitably caused various negative problems. In particular, various types of crimes triggered by the use of the Internet and information are increasing year by year, such as stealing state secrets. Incidents such as the disclosure of personal privacy, theft of online banking passwords, online fraud, hacking, etc., have also seen a significant increase in criminal, civil, and administrative cases or disputes associated with them. In order to meet the needs of litigation for such cases or disputes, computer forensics (digital forensics, electronic forensics) came into being.

Computer forensics is the process of identifying, storing, analyzing, and submitting electronic evidence in a manner consistent with laws and regulations using principles and methods in related disciplines such as computers, communications, and electronics. Since its inception in China, computer forensics has been in development for more than ten years, and has been recognized by government law enforcement agencies, practitioners in the legal profession, and law enforcement personnel in actual work. In the commercial field, more and more companies have begun to attach importance to the application of computer forensics technology for internal enterprise investigations and IT audits. It can be said that computer forensics technology is a rapidly developing research field with good application prospects. Especially after the new Criminal Procedure Law in 2012 independently stipulated the legal status of "electronic data", the importance of computer forensics technology became more prominent.

The object that computer forensics needs to obtain is electronic data. An important feature of electronic evidence, which is different from other physical evidence, is its vulnerability, which is mainly manifested in two aspects: on the one hand, because electronic data is stored in magnetic media or electronic components, Some of the characteristics of these media make the electronic data easy to be artificially damaged, so there are very strict restrictions on the preservation of evidence materials; on the other hand, electronic data can be easily modified or deleted, and this operation is often incomplete Recovered, even if it can be recovered, will have a great impact on the validity of the data.

Electronic evidence can only be recognized by the court if it follows a legal process and can be proved its authenticity, especially online forensics (Live Forensics is to obtain the target computer's memory, disk, etc. without shutting down the target computer or electronic equipment. However, during the research and development process, the inventor found that the data and status on various networks change instantly, so how to prove the authenticity of the obtained electronic evidence Sex becomes very difficult. At the same time, there are also problems such as DNS spoofing and untrustworthiness of forensics personnel. Therefore, we can only rely on professional electronic evidence judicial authentication institutions and notary institutions to obtain such evidence.

As shown in Figure 1, it shows the routine network electronic evidence collection process. Due to the characteristics of electronic data being easily tampered with, the process of obtaining and fixing the evidence in the routine forensic process must be carried out by a third-party institution (forensic appraisal agency). The user goes from collecting evidence (step 1) to fixing the evidence (step 3) by the judicial appraisal agency. It is necessary to sign an authentication agreement with the forensic authentication agency, entrust the forensic authentication agency to perform forensic authentication (step 2), the forensic authentication agency conducts judicial authentication based on the fixed electronic evidence (step 4), and issues a judicial authentication report to the user (step 5) . In the above process, the process from step 1 to step 3 generally takes at least a few days. Because the data on the network or various network APPs is constantly changing, when the judicial appraisal agency fixes the electronic evidence, the data is often very large. The change in the situation has delayed the opportunity to obtain evidence. In addition, when entrusting a judicial authentication agency to fix evidence, since there was no communication with the lawyer or the court at that time, the evidence requirements were not very clear. When the judicial authentication agency is entrusted to conduct judicial authentication, it is often blind, which will waste a certain amount of time and time. money.

To sum up, the conventional network electronic evidence collection process does not come in time for evidence collection, which brings about practical problems such as the data that you want to obtain is often deleted. A more credible method is needed to solve the current evidence collection problem.

Summary of the invention

In view of the shortcomings of the prior art, one or more embodiments of the present disclosure provide a method and system for fixing electronic evidence and network forensics based on memory forensics and blockchain, using computers to obtain webpages and various network APP electronic data online , The use of internal forensics technology, blockchain technology and special forensics tools to ensure the credibility of the source and process of obtaining electronic data, making the obtained electronic evidence difficult to tamper with.

According to one aspect of one or more embodiments of the present disclosure, there is provided a method for fixing electronic evidence based on an internal pass and a blockchain.

A method for fixing electronic evidence based on memory card and blockchain, the method includes:

Download credible forensics tools through the blockchain network;

Interact with the blockchain network to verify the legality of the execution code of the forensic tool;

Run forensic tools, obtain electronic data, and generate operation logs. At the same time, use internal forensics technology to obtain computer memory information and fix evidence;

Generate hash values of electronic data, operation logs and memory information respectively, upload them to the blockchain network, and receive the corresponding blockchain addresses returned.

Further, in this method, the verification of the legality of the execution code of the forensic tool is to verify that the execution code of the forensic tool has not been modified.

Further, the method also includes: when the obtained electronic evidence needs to be authenticated, sending the electronic evidence, memory information and the corresponding blockchain address to the terminal of the judicial authentication agency.

According to an aspect of one or more embodiments of the present disclosure, a computer-readable storage medium is provided.

A computer-readable storage medium stores a plurality of instructions, and the instructions are adapted to be loaded by a processor of an electronic device and execute the method for fixing electronic evidence based on memory card and blockchain.

According to an aspect of one or more embodiments of the present disclosure, an electronic device is provided.

An electronic device comprising a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store a plurality of instructions, the instructions are suitable for being loaded by the processor and executing the one A method of fixing electronic evidence based on internal deposit and withdrawal and blockchain.

According to an aspect of one or more embodiments of the present disclosure, there is provided an electronic evidence fixed terminal based on an internal pass and a blockchain.

An electronic evidence fixing terminal based on memory card and blockchain, based on the said method for fixing electronic evidence based on memory card and blockchain, includes:

The forensic tool download module is configured to download credible forensic tools through the blockchain network;

The legitimacy verification module is configured to interact with the blockchain network to verify the legitimacy of the code executed by the forensic tool;

The evidence fixation module is configured to run forensic tools, obtain electronic data, and generate operation logs. At the same time, it uses internal forensics technology to obtain computer memory information and fix evidence;

The blockchain upload module is configured to generate hash values for electronic data, operation logs, and memory information, upload them to the blockchain network, and receive the corresponding blockchain addresses returned.

Further, the electronic evidence fixing terminal further includes a communication module configured to send the electronic evidence, the memory information and the corresponding blockchain address to the terminal of the judicial authentication agency when the obtained electronic evidence needs to be authenticated.

According to one aspect of one or more embodiments of the present disclosure, a network forensics method based on internal access forensics and blockchain is provided.

A network forensics method based on internal deposit and withdrawal and blockchain, which is implemented in the terminal of a judicial authentication agency, including:

The blockchain address sent by the fixed terminal to receive the electronic evidence;

Query the information on the blockchain according to the blockchain address, verify the legality of electronic data, operation logs and memory information;

After the verification is passed, use internal forensics technology to analyze the memory information, extract the system status when the electronic evidence is obtained, and verify the consistency of the system status with the electronic evidence and operation log;

Use memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment;

Generate forensic identification reports.

Further, the verification of the legality of the electronic data, the operation log and the memory information is to verify that the electronic data, the operation log and the memory information have not been modified.

Further, the method further includes: sending a judicial authentication report to the user terminal.

A computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor of an electronic device and executing the aforementioned method for network forensics based on memory forensics and blockchain.

An electronic device comprising a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store a plurality of instructions, the instructions are suitable for being loaded by the processor and executing the one A network forensics method based on internal memory forensics and blockchain.

According to one aspect of one or more embodiments of the present disclosure, there is provided a network forensics terminal based on internal deposit and withdrawal and blockchain.

A network forensics terminal based on internal memory forensics and blockchain, based on the described network forensic method based on internal memory forensics and blockchain, includes:

The block chain address receiving module is configured to receive the block chain address sent by the electronic evidence fixed terminal;

The legitimacy verification module is configured to query the information on the blockchain based on the blockchain address and verify the legitimacy of electronic data, operation logs and memory information;

The first authentication module is configured to use memory forensics technology to analyze the memory information after the verification is passed, extract the system status when the electronic evidence is obtained, and verify the consistency of the system status with the electronic evidence and operation log;

The second identification module is configured to use memory analysis to verify whether the forensic tool is hooked or injected during operation, and to verify the reliability of its operating environment;

The report generation module is configured to generate forensic identification reports.

Further, the network forensics terminal further includes a communication module configured to send a judicial authentication report to the user terminal.

A network forensics method based on internal memory forensics and blockchain. The method is implemented in a network forensics system and includes:

The electronic evidence fixed terminal downloads credible forensic tools through the blockchain network; interacts with the blockchain network to verify the legality of the forensic tool's execution code; runs the forensic tool to obtain electronic data, and generate operation logs, and use internal forensic technology to obtain Computer memory information for evidence fixation; generate hash values for electronic data, operation logs and memory information respectively, upload them to the blockchain network, and receive the corresponding blockchain address returned; when the electronic evidence obtained needs to be authenticated , Send the electronic evidence, memory information and the corresponding blockchain address to the terminal of the judicial authentication agency;

The terminal of the judicial appraisal institution receives the blockchain address sent by the fixed terminal of the electronic evidence; queries the information on the blockchain according to the blockchain address to verify the legality of the electronic data, operation log and memory information; after the verification is passed, the internal memory forensic technology is adopted Analyze the memory information, extract the system status when the electronic evidence is obtained, and verify the consistency of the system status with the electronic evidence and operation log; use memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment; generate justice Identification report.

According to one aspect of one or more embodiments of the present disclosure, there is provided a network forensics system based on memory forensics and blockchain.

A network forensics system based on internal and external forensics and blockchain, based on the described network forensic method based on internal and external forensics and blockchain, the system includes: electronic evidence fixed terminal and judicial authentication agency terminal;

The electronic evidence fixed terminal downloads a credible forensic tool through the blockchain network; interacts with the blockchain network to verify the legality of the forensic tool's execution code; runs the forensic tool to obtain electronic data and generate an operation log, while using memory Forensics technology obtains computer memory information and fixes evidence; generates hash values for electronic data, operation logs, and memory information respectively, uploads them to the blockchain network, and receives the corresponding blockchain address returned; when needed, the electronic evidence obtained When conducting authentication, send the electronic evidence, memory information and its corresponding blockchain address to the terminal of the judicial authentication agency;

The judicial authentication agency terminal receives the blockchain address sent by the electronic evidence fixed terminal; queries the information on the blockchain according to the blockchain address to verify the legitimacy of the electronic data, operation log and memory information; after the verification is passed, use Internal forensics technology analyzes memory information, extracts the system status when electronic evidence is obtained, and verifies the consistency of the system status with the electronic evidence and operation log; uses memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment ; Generate a forensic appraisal report.

The beneficial effects of the present disclosure:

The present disclosure provides a method and system for fixing electronic evidence and network forensics based on memory forensic and blockchain. Through the method for fixing electronic evidence based on memory forensic and blockchain, the electronic evidence is fixed and forwarded, avoiding the delay in obtaining evidence. Problem: The use of memory forensics technology, blockchain technology and specialized forensic tools ensures the credibility of the source and process of obtaining electronic data, making the obtained electronic evidence difficult to tamper with, and making the obtained evidence easier to be accepted by the court.

Description of the drawings

The drawings of the specification forming a part of the application are used to provide a further understanding of the application, and the exemplary embodiments and descriptions of the application are used to explain the application, and do not constitute an improper limitation of the application.

Figure 1 is a schematic diagram of the routine law enforcement evidence collection process;

Fig. 2 is a flow chart of a method for fixing electronic evidence based on memory card and blockchain according to one or more embodiments;

Figure 3 is a schematic diagram of a law enforcement evidence collection process according to one or more embodiments;

Fig. 4 is a flowchart of a method for network forensics based on memory forensics and blockchain according to one or more embodiments;

Fig. 5 is a flowchart of another network forensics method based on memory forensics and blockchain according to one or more embodiments.

Detailed ways:

The following will clearly and completely describe the technical solutions in one or more embodiments of the present disclosure with reference to the accompanying drawings in one or more embodiments of the present disclosure. Obviously, the described embodiments are only part of the implementation of the present disclosure. Examples, not all examples. Based on one or more embodiments of the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

It should be pointed out that the following detailed descriptions are all illustrative and are intended to provide further explanations for the application. Unless otherwise specified, all technical and scientific terms used in this embodiment have the same meaning as commonly understood by those of ordinary skill in the technical field to which this application belongs.

It should be noted that the terms used here are only for describing specific embodiments, and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprising" and/or "including" are used in this specification, they indicate There are features, steps, operations, devices, components, and/or combinations thereof.

It should be noted that the flowcharts and block diagrams in the drawings illustrate the possible implementation architecture, functions, and operations of the method and system according to various embodiments of the present disclosure. It should be noted that each block in the flowchart or block diagram may represent a module, program segment, or part of code, and the module, program segment, or part of code may include one or more for implementing the various embodiments. Executable instructions for the specified logic function. It should also be noted that, in some alternative implementations, the functions noted in the block may also occur in a different order than that noted in the drawings. For example, two blocks shown in succession may actually be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the flowchart and/or block diagram, and the combination of the blocks in the flowchart and/or block diagram, can be implemented using a dedicated hardware-based system that performs the specified functions or operations. Or it can be implemented using a combination of dedicated hardware and computer instructions.

In the case of no conflict, the embodiments in the present disclosure and the features in the embodiments can be combined with each other, and the present disclosure will be further described below with reference to the drawings and embodiments.

Example one

According to one aspect of one or more embodiments of the present disclosure, there is provided an electronic evidence fixing and network forensics method based on internal deposit and withdrawal and blockchain.

As shown in FIG. 2, according to one aspect of one or more embodiments of the present disclosure, a method for fixing electronic evidence based on memory card and blockchain is provided.

S101: Download credible forensics tools through the blockchain network;

S102: Interact with the blockchain network to verify the legality of the execution code of the forensic tool;

S103: Run forensic tools to obtain electronic data and generate operation logs. At the same time, internal forensic technology is used to obtain computer memory information to fix evidence;

S104: Generate hash values for electronic data, operation logs, and memory information, upload them to the blockchain network, and receive the corresponding blockchain addresses returned.

In step S101 of this embodiment, a special forensic tool is obtained and downloaded from the blockchain network; a trusted special forensic tool is downloaded from the blockchain network on a computer, and the forensic tool is run. The forensics tools in this disclosure all use existing computer forensics tools. In the computer forensics process, the common Tcpdump, Argus, NFR, Tcpwrapper, Sniffers, Honeypot, Tripwires, Network monitor, disk mirroring, web page fixation, Forensic tools such as memory acquisition/analysis.

In step S102 of this embodiment, the forensic tool interacts with the blockchain before running, and the verification of the legality of the execution code of the forensic tool is to verify that the execution code of the forensic tool has not been modified.

In steps S103 and S104 of this embodiment, the specific steps include:

Use this forensics tool to obtain web page information and electronic data of various APPs, fix evidence, generate audit logs for each step of operation and operation results, and use hash functions to generate hash values for fixed evidence and logs. The hash value/fixed evidence/audit log is uploaded to the blockchain network.

While performing the following steps, use memory forensics technology to obtain computer memory information, fix the evidence, and upload the hash value of the memory information to the blockchain network.

Memory Forensics: Acquire and analyze the temporary data stored in the physical memory of computers and related smart devices when they are running, and extract valuable data. The memory is the area where the operating system and various software exchange data. Data is easy to lose (Volatile), and usually the data disappears soon after shutdown. In this embodiment, the Windows/Linux system access forensic method previously applied by the applicant is used to obtain and analyze computer memory information.

Specifically, in step S103 of this embodiment, the forensic tool is run,

1) Run webpage fixed forensics tools to obtain webpage or various APP information, various operating environment information and other electronic evidence;

2) Run any forensic tool to generate operation logs for the acquisition process;

3) Run the memory acquisition forensics tool to obtain computer memory mirroring information.

In step S104 of this embodiment, the forensic tool uses the hash function to generate hash values for the acquired electronic evidence, operation log, and memory mirroring information, respectively, and hash values of the evidence, operation log and its hash value, and memory mirroring information. Value, uploaded to the blockchain. The blockchain returns the blockchain address to the forensics tool.

In one or more embodiments of the present disclosure, if the user needs the evidence, the fixed evidence is provided to the judicial authentication agency, and the judicial authentication agency conducts judicial authentication based on the electronic evidence and the information of the blockchain: using memory forensics technology to obtain security In the process of obtaining evidence, the system has not been illegally invaded, and other behaviors that may affect the authenticity of the evidence are excluded, and blockchain technology is used to ensure that the data in the entire process has not been modified. Judicial authentication institutions shall issue judicial authentication reports based on the authentication results.

As shown in Figure 3, one or more embodiments of the present disclosure change the "fixed link of evidence" in the original network data forensic process from a work that must be done by a third-party organization to any individual or unit. That is, from the original process of "finding electronic evidence-entrusting a third party to provide judicial fixation services and appraisal services-third parties for evidence fixation-third parties for judicial firmness and issuing judicial appraisal reports" to "finding electronic evidence-evidence fixation services" -Entrust a third party to conduct judicial identification-The third party conducts judicial identification and issues a judicial identification report".

One or more embodiments of the present disclosure avoid the problem of delay in obtaining evidence. Since the current network data collection methods are not credible, the evidence can only be fixed by judicial authentication agencies or notary agencies. Since the discovery of electronic evidence leads to a third-party agency for evidence fixation, business entrustment (including price negotiation, seals between the two parties), business arrangement, evidence fixation and other stages need to be carried out, which takes a period of time. However, website data and social APP Data changes rapidly, which often results in that the data to be collected has been modified when collecting evidence, and the required evidence cannot be obtained.

The cost is saved. Since the evidence fixation can be done by any individual or unit, and no third-party organization is needed, it obviously saves a lot of evidence fixation costs.

The method of obtaining is more credible, making the obtained evidence easier to be accepted by the court.

Example two

Example three

When these computer-executable instructions run in the device, the device executes the methods or processes described in the various embodiments of the present disclosure.

In this embodiment, the computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for executing various aspects of the present disclosure. The computer-readable storage medium may be a tangible device that can hold and store instructions used by the instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (non-exhaustive list) include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) Or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, such as a printer with instructions stored thereon The protruding structure in the hole card or the groove, and any suitable combination of the above. The computer-readable storage medium used here is not interpreted as a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, light pulses through fiber optic cables), or through wires Transmission of electrical signals.

The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to various computing/processing devices, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network, and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing/processing device .

The computer program instructions used to perform the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or in one or more programming languages Source code or object code written in any combination of, the programming language includes object-oriented programming languages-such as C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions can be executed entirely on the user's computer, partly on the user's computer, executed as a stand-alone software package, partly on the user's computer and partly executed on a remote computer, or entirely on the remote computer or server carried out. In the case of a remote computer, the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to access the Internet connection). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), can be customized by using the status information of the computer-readable program instructions. The computer-readable program instructions are executed to implement various aspects of the present disclosure.

Example four

It should be noted that although several modules or sub-modules of the device are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules described above may be embodied in one module. Conversely, the features and functions of a module described above can be further divided into multiple modules to be embodied.

Example five

As shown in Figure 4, a network forensics method based on internal deposit and withdrawal and blockchain, which is implemented in the terminal of a judicial authentication agency, includes:

S201: Receive the blockchain address sent by the fixed terminal of the electronic evidence;

S202: Query the information on the blockchain according to the blockchain address, and verify the legality of the electronic data, operation log and memory information;

S203: After the verification is passed, use internal forensics technology to analyze the memory information, extract the system state when the electronic evidence is obtained, and verify the consistency of the system state with the electronic evidence and operation log;

S204: Use memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment;

S205: Generate a judicial appraisal report.

According to the content on the blockchain address and the electronic evidence provided by the user, the judicial authentication agency terminal does the following tasks:

1) Query the information on the blockchain to verify whether the electronic evidence, operation log, and memory mirror information have been modified;

2) After the verification is passed, use internal forensics technology to analyze the memory mirroring information, extract the system status when the evidence is obtained, and verify that the system status is consistent with the electronic data/operation log and other information;

3) Use memory analysis technology to verify that the forensic tool is not hooked or injected during operation, and verify the reliability of its operating environment.

Example Six

Example Seven

Example eight

Example 9

As shown in Figure 5, a network forensics method based on internal memory forensics and blockchain, which is implemented in a network forensics system, includes:

Step S101: The fixed terminal of electronic evidence downloads a credible forensics tool through the blockchain network; Step S102: Contact

Block chain network interaction to verify the legality of the execution code of the forensic tool;

Step S103: Run a forensic tool to obtain electronic data and generate an operation log. At the same time, internal forensic technology is used to obtain computer memory information, and evidence is fixed;

Step S104: Generate hash values for electronic data, operation logs and memory information respectively, upload them to the blockchain network, and receive the corresponding blockchain addresses returned;

When the obtained electronic evidence needs to be authenticated, the electronic evidence fixed terminal sends the electronic evidence, memory information and its corresponding blockchain address to the terminal of the judicial authentication agency;

Step S201: the terminal of the judicial authentication agency receives the blockchain address sent by the fixed terminal of the electronic evidence;

Step S202: The terminal of the judicial authentication agency queries the information on the blockchain according to the blockchain address, and verifies the legality of the electronic data, operation log and memory information;

Step S203: After the judicial authentication agency passes the verification through the terminal, it uses memory forensics technology to analyze the memory information, extracts the system status when the electronic evidence is obtained, and verifies the consistency of the system status with the electronic evidence and operation log;

Step S204: The terminal of the judicial authentication agency uses memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment;

Step S205: the judicial authentication agency terminal generates a judicial authentication report.

As shown in Figure 3, the network forensics process based on internal memory forensics and blockchain technology is adopted. In the process of obtaining evidence for network data or various network app data according to the implementation of this patent, the user collects and fixes electronic data including computer memory on demand with the support of blockchain technology (step 1), and then fixes the evidence, and then Entrust a judicial authentication agency to conduct judicial authentication on electronic evidence as needed (step 2). The judicial authentication agency conducts judicial authentication based on the data, memory data and electronic evidence on the blockchain, and verifies that the electronic evidence has not been modified after acquisition and acquisition (Step 3), and issue a judicial report to the user (Step 4).

It can be seen from the comparison between Figure 1 and Figure 3 that by adopting the method of this patent, the unit or individual who needs evidence can collect and fix evidence according to their own needs, which can effectively reduce the link and processing time of evidence formation, and also avoid secondary Potential hidden dangers of alteration and destruction of original evidence caused by the time interval of collecting evidence.

Example ten

The above descriptions are only preferred embodiments of the application, and are not used to limit the application. For those skilled in the art, the application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the protection scope of this application. Therefore, the present invention will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

Claims

A method for fixing electronic evidence based on memory card and blockchain, characterized in that the method includes:

Download credible forensics tools through the blockchain network;

Interact with the blockchain network to verify the legality of the execution code of the forensic tool;

Run forensic tools, obtain electronic data, and generate operation logs. At the same time, use internal forensics technology to obtain computer memory information and fix evidence;

Generate hash values of electronic data, operation logs and memory information respectively, upload them to the blockchain network, and receive the corresponding blockchain addresses returned.
The method for fixing electronic evidence based on memory forensics and blockchain according to claim 1, characterized in that, in the method, the verification of the legality of the execution code of the forensic tool is to verify that the execution code of the forensic tool has not been modified Over

Or, the method further includes: when the obtained electronic evidence needs to be authenticated, sending the electronic evidence, the memory information and the corresponding blockchain address to the terminal of the judicial authentication agency.
A computer-readable storage medium, wherein a plurality of instructions are stored, wherein the instructions are adapted to be loaded by a processor of an electronic device and executed according to any one of claims 1-2. And the electronic evidence fixing method of the blockchain.
An electronic device comprising a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, characterized in that the instructions are suitable for being loaded and executed by the processor A method for fixing electronic evidence based on memory card and blockchain according to any one of claims 1-2.
A network forensics method based on internal deposit and withdrawal and blockchain, characterized in that the method is implemented in the terminal of a judicial authentication agency, and includes:

The blockchain address sent by the fixed terminal to receive the electronic evidence;

Query the information on the blockchain according to the blockchain address, verify the legality of electronic data, operation logs and memory information;

After the verification is passed, use internal forensics technology to analyze the memory information, extract the system status when the electronic evidence is obtained, and verify the consistency of the system status with the electronic evidence and operation log;

Use memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment;

Generate forensic identification reports.
A network forensics method based on internal access forensics and blockchain according to claim 5, wherein the verification of the legality of electronic data, operation logs and memory information is to verify the validity of electronic data, operation logs and memory information. Has been modified

Or, the method further includes: sending the forensic identification report to the user terminal.
A computer-readable storage medium, wherein a plurality of instructions are stored, wherein the instructions are adapted to be loaded by the processor of an electronic device and executed according to any one of claims 5-6 based on the memory card and The blockchain network forensics method.
An electronic device comprising a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, characterized in that the instructions are suitable for being loaded and executed by the processor A network forensics method based on internal access forensics and blockchain according to any one of claims 5-6.
A network forensics method based on memory forensics and blockchain, characterized in that the method is implemented in a network forensics system, and includes:

The electronic evidence fixed terminal downloads credible forensic tools through the blockchain network; interacts with the blockchain network to verify the legality of the forensic tool's execution code; runs the forensic tool to obtain electronic data, and generate operation logs, and use internal forensic technology to obtain Computer memory information for evidence fixation; generate hash values for electronic data, operation logs and memory information respectively, upload them to the blockchain network, and receive the corresponding blockchain address returned; when the electronic evidence obtained needs to be authenticated , Send the electronic evidence, memory information and the corresponding blockchain address to the terminal of the judicial authentication agency;

The terminal of the judicial appraisal institution receives the blockchain address sent by the fixed terminal of the electronic evidence; queries the information on the blockchain according to the blockchain address to verify the legality of the electronic data, operation log and memory information; after the verification is passed, the internal memory forensic technology is adopted Analyze the memory information, extract the system status when the electronic evidence is obtained, and verify the consistency of the system status with the electronic evidence and operation log; use memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment; generate justice Identification report.
A network forensics system based on internal memory certificates and blockchains, characterized in that, based on a network forensics method based on internal memory certificates and blockchains as claimed in claim 9, the system includes: electronic evidence fixed terminals and judicial Appraisal agency terminal;

The electronic evidence fixed terminal downloads a credible forensic tool through the blockchain network; interacts with the blockchain network to verify the legality of the forensic tool's execution code; runs the forensic tool to obtain electronic data and generate an operation log, while using memory Forensics technology obtains computer memory information and fixes evidence; generates hash values for electronic data, operation logs, and memory information respectively, uploads them to the blockchain network, and receives the corresponding blockchain address returned; when needed, the electronic evidence obtained When conducting authentication, send the electronic evidence, memory information and its corresponding blockchain address to the terminal of the judicial authentication agency;

The judicial authentication agency terminal receives the blockchain address sent by the electronic evidence fixed terminal; queries the information on the blockchain according to the blockchain address to verify the legitimacy of the electronic data, operation log and memory information; after the verification is passed, use Internal forensics technology analyzes memory information, extracts the system status when electronic evidence is obtained, and verifies the consistency of the system status with the electronic evidence and operation log; uses memory analysis to verify whether the forensic tool is hooked or injected during operation, and verify the reliability of its operating environment ; Generate a forensic appraisal report.