CN114217690A

CN114217690A - A training method for electronic data extraction based on virtual simulation technology

Info

Publication number: CN114217690A
Application number: CN202111483062.9A
Authority: CN
Inventors: 王新猛; 陈俊雹; 杨一涛; 翟春婕; 吴育宝
Original assignee: Nanjing Forest Police College
Current assignee: Nanjing Forest Police College
Priority date: 2021-12-07
Filing date: 2021-12-07
Publication date: 2022-03-22

Abstract

The invention discloses a training method for electronic data extraction based on a virtual simulation technology, which carries out practical training on students through a virtual simulation platform, wherein the practical training comprises various links of case site investigation. The virtual simulation training content comprises electronic data field investigation, network security field law enforcement, network case investigation and deduction, computer evidence-obtaining technical experiments and law and regulation learning and assessment. In the training process, various tools in a tool box can be used for processing various electronic devices involved in a case in a virtual 3D scene, and a virtual machine can be used for simulating a real computer to obtain evidence of electronic data in the real computer. The operated material evidence information can be viewed in a menu bar of the virtual scene. The practical training comprises the following steps: the method comprises the steps of exploration preparation, on-site protection, on-site photographing, electronic data equipment searching, computer data extraction and fixation, mobile phone data extraction and fixation, wireless network extraction and fixation, filling in on-site exploration documents, electronic data equipment sealing and comprehensive drilling.

Description

Training method for electronic data extraction based on virtual simulation technology

Technical Field

The invention relates to a training method for electronic data extraction based on a virtual simulation technology, and belongs to the technical field of electronics.

Background

At present, the training of electronic data extraction mainly comprises that an operator extracts electronic data from a physical computer by configuring a real computer and installing an operating system to preset related case data. The method has high cost, high consumption, irreversibility and low utilization rate, can not be used for automatic evaluation and assessment, and can not meet the requirement of batch training.

The virtual simulation technology is applied to teaching training, so that the training cost is low, the consumption is low, the efficiency is high, the evaluation is automatically carried out, and the condition that multiple persons carry out simultaneously can be met.

The expression mode of the existing electronic data extraction virtual simulation training is that an operator performs skill and law enforcement standardized training in a virtual three-dimensional scene through a computer keyboard and a mouse, when the electronic data extraction training in a case-related computer is involved in a case-related piece and pit site field investigation scene, the electronic data extraction training is introduced only through animation, characters or voice, only the flow and technical specification of electronic data extraction are shown, and the capability of the operator for extracting the electronic data by actual operation cannot be trained.

Disclosure of Invention

The invention aims to provide a training method for electronic data extraction based on a virtual simulation technology, aiming at overcoming the defects of the prior art. The virtual simulation training content comprises electronic data field investigation, network security field law enforcement, network case investigation and deduction, computer evidence-obtaining technical experiments and law and regulation learning and assessment. In the training process, various tools in a tool box can be used for processing various electronic devices involved in a case in a virtual 3D scene, and a virtual machine can be used for simulating a real computer to obtain evidence of electronic data in the real computer. The operated material evidence information can be viewed in a menu bar of the virtual scene. The training steps comprise: the method comprises the steps of exploration preparation, on-site protection, on-site photographing, electronic data equipment searching, computer data extraction and fixation, mobile phone data extraction and fixation, wireless network extraction and fixation, filling in on-site exploration documents, electronic data equipment sealing and comprehensive drilling.

The technical scheme adopted by the invention for solving the technical problems is as follows: a training method for electronic data extraction based on a virtual simulation technology comprises the following steps:

step 1: and logging in the 3D virtual simulation platform.

Step 2: and (5) preparing for exploration. Various preparations are made before entering the 3D virtual site, including various electronic evidence obtaining devices, related documents and other articles.

And step 3: and (4) field protection. And after entering the site, all objects on the site are protected.

And 4, step 4: and taking a picture on site. And carrying out image and video acquisition on the original appearance of the case site.

And 5: electronic data device searching. The site is carefully searched to find the electronic data equipment.

Step 6: and extracting and fixing computer data, mobile phone data, wireless networks and the like. Electronic data devices include computers, mobile phones, servers, network devices, etc., and should operate differently for different devices.

And 7: filling in the field survey document. After all the devices on the case site are certified, the complete document should be filled in.

And 8: and sealing and storing the electronic data equipment. And (4) sealing all electronic data equipment before leaving the site.

And step 9: and (5) performing a comprehensive drilling link. Including forensics exercise question types of various conditions, and randomly drawing questions from the question bank for exercise.

Step 10: and exiting the virtual training platform and displaying the performance of the drill.

The links comprise an assessment mechanism, and whether the operation of the students is correct or not can be scored.

Has the advantages that:

1. the invention carries out practical training on students through the virtual simulation platform, and the practical training comprises various links of case site investigation. The virtual simulation training content comprises electronic data field investigation, network security field law enforcement, network case investigation and deduction, computer evidence-obtaining technical experiments and law and regulation learning and assessment.

2. The virtual simulation training method disclosed by the invention has the advantages that an operator can roam in a virtual three-dimensional scene in a virtual and real combination mode, the content of the virtual simulation training of the training method is completely covered, and the virtual simulation training method comprises electronic data field investigation, network security field law enforcement, network case investigation deduction, computer evidence obtaining technical experiment and law and regulation learning and assessment. Beneficial to the omnibearing cultivation of the exploration ability of students. The training method has rich details of the training process, can process various electronic devices involved in a case by using various tools in a tool box in a virtual 3D scene, and can simulate a real computer by using a virtual machine to obtain evidence of electronic data in the real computer. The operated material evidence information can be viewed in a menu bar of the virtual scene. Is beneficial to the cultivation of strict and serious habits of students in the process of evidence collection.

Drawings

FIG. 1 is a flow chart of the method of the present invention.

FIG. 2 is a flow chart of the electronic data extraction training of the present invention.

Detailed Description

The invention is described in further detail below with reference to the drawings.

As shown in fig. 1 and fig. 2, the present invention provides a training method for electronic data extraction based on virtual simulation technology, and the method includes:

step 1: and logging in the 3D virtual simulation platform. The student is required to enter a login name, which is a string N of alphanumeric symbols, and a password, which is a string P of alphanumeric symbols.

Step 2: and (5) preparing for exploration. Various preparations are made before entering the 3D virtual site, including various electronic evidence obtaining devices, related documents and other articles. Need toThe prepared articles are combined into a list a ═ a₁,a₂…a_n]Wherein a is_iFor each particular item in the list. The verification process compares a to a criteria list b, b ═ b₁,b₂,…b_n]Wherein b is_iFor each item in the criteria list. The verification rule is that each element in a is proposed in turn and verified with each element in b, and if all elements in a are found, the verification is passed. The whole process of survey preparation is a visual presentation and appears in the form of multiple choice questions, and the options clicked by a mouse are stored in an a list.

And step 3: and (4) field protection. And after entering the site, all articles on the site are protected. In the field, the direction key is used for controlling the forward and backward, and the mouse is used for controlling the visual field direction. And selecting proper props to protect the objects needing to be protected. Suitable props are a list c ═ c₁,c₂…c_n]The object to be protected is a list d ═ d₁,d₂…d_n]The elements in c and the elements in d may form multiple combinations, represented as a dictionary (c)_i:d_j). The corresponding standard props and item lists are e and f, and form a plurality of dictionaries (e)_i:f_j). The whole process of on-site protection is realized in a 3D scene, a user is required to select props when interacting with objects in the scene, and when interaction occurs, the props and the objects are stored in a dictionary.

And 4, step 4: and taking a picture on site. And carrying out image and video acquisition on the original appearance of the case site. The shooting in the scene needs to select a proper prop (a camera or a video recorder), and g is [ g ]₁,g₂…g_n]For the selected prop list, h ═ h₁,h₂…h_n]The elements in g and h may form a dictionary mapping for the scene list that needs to be photographed. The specific verification process is the same as the third step.

And 5: electronic data device searching. And (4) interactively searching with an article in a 3D site, if F appears, pressing an F key to check, and judging whether the electronic data equipment is used. The verified item may also be stored in a list l ═ l₁,l₂…l_n]The verification step is the same as the second step.

Step 6: and extracting and fixing computer data, mobile phone data, wireless networks and the like. Electronic data devices include computers, mobile phones, servers, network devices, etc., and should operate differently for different devices. The process enters an independent virtual machine, then various evidence obtaining operations can be carried out in the virtual machine, and evidence can be found and verified with answers by using various tools of the virtual machine.

And 7: filling in the field survey document. After all the devices on the case site are certified, the complete document should be filled in. Document validation occurs as a blank filling question.

And 8: and sealing and storing the electronic data equipment. And (4) sealing all electronic data equipment before leaving the site. The sealed article is the list generated in the step five, wherein l is [ l ═ l₁,l₂…l_n]。

Step 10: and exiting the virtual training platform and displaying the performance of the drill. The answers in the above nine steps are weighted and summed to get the score. Students can view wrong answers in the system.

The method comprises the following steps of firstly, starting a computer, wherein the step six of carrying out electronic data extraction on the started computer in a computer crime scene specifically comprises the following steps: the method directly enters a virtual machine to simulate a real computer, and an operator carries out actual operation in the virtual machine so as to train the ability of the operator to extract electronic data by actual operation. The using method comprises the following steps:

step 6-1: the focus of the mouse is transplanted to a computer screen, and an F key in a keyboard is pressed to enter a virtual machine real operation interface.

Step 6-2: and after entering a virtual machine interface, carrying out electronic data extraction operation.

The power-on state is first checked. In the case of a boot, the following steps are followed:

1. extracting time information;

2. inserting a special U disk to run green screen recording software;

3. extracting screen information;

video + screenshot software

4. Fill in electronic data on-site extraction notes (electronic data extraction fixed list)

5. Memory data fetch

-open and unsaved document

-most recent chat history

User name and password

-clipboard information

6. System information extraction

-state of the storage medium: screenshot hard disk partition and capacity storage state

-operating system information: viewing computer attributes

-a running process: view task manager

-network link information: viewing network connections in a control panel

7. User information extraction

-a chat log in a running chat tool;

-an open web page;

8. data extraction with password protection

-an instant messaging tool: extracting related backup files by virtue of the Aliwang technology and the like;

9. electronic data fixing

-computing the integrity check value in situ, computing the hash value

Recording the file type, user name, password, source path, hash value of the data extraction in the dedicated U disk.

Filling in an electronic data field extraction bibliography 10 notes the source, the source and the destination of electronic data, objects, time, places, methods, processes and the like for extracting the electronic data. Electronic data extraction fixed List notes categories, file formats, integrity check values, etc

And simultaneously, relevant test questions need to be answered synchronously on the left side of the browser.

1. Start time of evidence collection

2. Whether to automatically acquire IP

Ipv4 Address

4. Default gateway

5. Total size of hard disk

6. Memory capacity

7. Type of computer processor

8. Value of password txt file md5 in recycle bin

9. And the found encrypted file cracks the password.

Hidden folder md5 value in D disc.

It should be understood that the above description of specific embodiments is not intended to limit the invention, and any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. a training method based on the electronic data extraction of virtual simulation technology, is characterized in that, described method comprises the steps:

Step 1: Log in to the 3D virtual simulation platform;

Step 2: Preparing for investigation, making various preparations before entering the 3D virtual scene, including various electronic forensics equipment and related documents;

Step 3: On-site protection, protect all objects on site after entering the site;

Step 4: Take pictures on the spot, and collect images and videos of the original appearance of the case;

Step 5: Search for electronic data equipment, search the scene carefully and find electronic data equipment;

Step 6: The extraction of computer data, mobile phone data, and wireless network is fixed. Electronic data devices include computers, mobile phones, servers, and network devices, and different operations should be performed on different devices;

Step 7: Fill in the on-site investigation documents. After collecting evidence for all the equipment on the case site, you should fill in the complete documents;

Step 8: Seal the electronic data equipment, and seal all the electronic data equipment before leaving the site;

Step 9: Comprehensive drills, including forensic drills in various situations, randomly selected from the test question bank for drills;

Step 10: Exit the virtual training platform and display the results of this exercise.

2. a kind of training method based on the electronic data extraction of virtual simulation technology according to claim 1, is characterized in that, described method carries out practical training to students by virtual simulation platform, and practical training includes various links of case on-site investigation The content of virtual simulation training covers electronic data on-site investigation, network security on-site law enforcement, network case investigation and deduction, computer forensics technology experiments, and learning and assessment of laws and regulations.

3. a kind of training method based on the electronic data extraction of virtual simulation technology according to claim 1, is characterized in that, described step 4 comprises: carry out image and video collection to the original appearance of the case site, and need to select camera or video recorder for on-site photographing , g=[g ₁ , g ₂ ... g _n ] is the list of selected props, h=[h ₁ , h ₂ ... h _n ] is the list of scenes to be photographed, and each element in g and h can form a dictionary mapping.