An electronic evidence fixing method, terminal equipment and storage medium

Abstract

The invention relates to an electronic evidence fixing method, a terminal device and a storage medium. The method comprises the following steps of 1, compressing data information and adding the compressed data information to a buffer queue A; 2, collecting data contents, adding the collected data contents to a buffer queue B, encrypting and compressing the data contents in the buffer queue B, andadding the encrypted and compressed data contents to the buffer queue A; 3, judging whether data blocks in the buffer sequence A meet standardization requirements or not in real time; 4, constructingaddressing list data in the buffer queue A, encrypting the addressing list data, and adding the encrypted addressing list data to an addressing list data region; 5, copying the data blocks in the buffer sequence A to a backup region of a mirror image file; and 6, constructing a file control region in the mirror image file. Through simplified structured design, network resources comprised in computer software and hardware can be effectively and correctly fully utilized in the creation and usage processes of the evidence mirror image file.

Description

Technical field [0001] The present invention relates to the technical field of information security, in particular to an electronic evidence fixing method, terminal equipment and storage medium. Background technique [0002] The first step in electronic data forensics is evidence fixation. Evidence fixation refers to the process of obtaining data from a suspect computer or storage medium or mobile terminal. Evidence fixation must comply with strict operating specifications and must be performed by qualified personnel using professional data acquisition tools. At the same time, the mirror file must be judged to be judicially valid. [0003] There are two main storage methods for evidence fixation, one is to copy and store the electronic evidence on the target storage medium, and the other is to make the electronic evidence into a mirror file. In the early days, the main fixed method of electronic data forensics was the first type of target storage media to copy and store. With th...

AI Technical Summary

Problems solved by technology

[0014] Insufficient foresight of the speed and scale of the increase in storage capacity of the storage medium, and flaws in the structural design make the computer unable to effectively manage the memory during application

[0015] Insufficient foresight of the scene changes in the application of the forensic system, as well as flaws in the structural design, cannot efficiently support multi-terminal, multi-task concurrent distributed forensic analysis

Images