CN109710899B - File decryption and evidence collection method and device in storage medium - Google Patents

Abstract

The invention discloses a method and device for decrypting files in a storage medium and obtaining evidence, and relates to the technical field of data processing. The method of decrypting and extracting the file includes: connecting the storage medium submitted for inspection such as a U disk to the inspection device through a read-only interface, using tool software to open the storage medium to be inspected, and exporting the folder Thumbs.dn to be decrypted and the mobile encryption program to In the local directory, read the character array named 117789687 under the Thumbs.dn folder, convert the string array into a string according to the ASCII code, decrypt the string, and save all the calculated results in the new In the character array of , convert the array into a string with UTF8 encoding, and the result is the key. Under the same directory of Thumbs.dn, run the mobile encryption software program, enter the key and click OK, and the original files will appear under this directory. , compared with the traditional extraction method, not only is the speed faster, but also the names of all files are the original file names, which ensures the integrity of the original files.

Description

File decryption and evidence collection method and device in storage medium

technical field

The invention relates to the field of file decryption and evidence collection, in particular to a method and device for file decryption and evidence collection in a folder-encrypted storage medium.

Background technique

With the rapid development and widespread popularization of mobile storage devices, the information contained in the storage media has become an important source of clues and evidence for criminal investigation. Due to the enhanced anti-investigation awareness of criminals, the TF cards and U disks involved in the case often contain encrypted files, especially in cases involving cult organizations, folder encryption is common. In order to solve cases, maintain social stability, and crack down on crimes, it is extremely important to decrypt, restore, and collect evidence.

During the technical inspection of storage media such as TF cards, SD cards, and U disks, the inventor encountered a folder encryption software (hereinafter referred to as "mobile encryption software") that can be quickly encrypted. Download and use for free. The data encrypted by this software exists in hundreds of inspection materials in many cult cases accepted. To inspect the inspection materials according to the existing technology, it is necessary to use professional forensics software such as Forensics Master and X-ways Forensics (hereinafter referred to as "X-ways") to open the U disk and other inspection materials, and forcibly recover the data.

In the process of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

One is that after using X-ways and other software to restore the encrypted USB flash drive, the file name cannot be obtained. After forced data recovery, the file names are all serial numbers with Arabic numerals increasing in sequence, and the integrity of the data file cannot be guaranteed. In the case of a huge amount of data, it is impossible to intuitively obtain the approximate content of the file through the file name. The second is that the efficiency is relatively low. When inspecting a large number of inspection materials, it is impossible to quickly restore the files in the medium.

Contents of the invention

In order to improve the inspection efficiency, ensure the integrity of the data, and provide the client with investigation clues and litigation evidence in a timely manner, the embodiment of the present invention provides a method and device for decrypting files in the storage medium and obtaining evidence.

On the one hand, a method for decrypting and obtaining evidence from files in a storage medium is provided, which is used for decrypting and extracting encrypted files in the storage medium.

The method includes: a connection step, connecting the storage medium submitted for inspection, such as a U disk, to the inspection equipment through a read-only interface. During the inspection, according to the inspection regulations GB/T electronic evidence data recovery inspection regulations, all inspection materials must be kept only read.

In the copying step, use X-ways or other tool software to open the storage medium to be checked, and copy the folder Thumbs.dn to be decrypted and the mobile encryption program to the local directory in a read-only manner through the read-only interface.

Read the steps, find the key file named "117789687" in the Thumbs.dn folder, or it may be another name. The feature of this file is that it has no extension. Use X-ways to view its content as a string of letters or Combination of numbers, read the character array named 117789687 under the Thumbs.dn folder.

In the conversion step, the string array is converted into a string according to the ASCII encoding.

The decryption step is to perform a decryption operation on the string, and the specific operation is as follows:

First split the string, every two characters as a group, because the length of the ASCII code is 2;

For characters with odd digits, perform XOR operation with 5, because XOR operation is a bit operation, so all characters need to be converted to binary during operation, and the insufficient digits are filled with binary numbers 0;

For characters with an even number, perform XOR operation with 4;

Save all the calculated results in a new character array in order;

Convert the array to a string in UTF8 encoding, and the result is the key.

Obtaining steps, in the same directory of Thumbs.dn, run the mobile encryption software program, a window for entering the key will pop up, enter the key and click OK, and the original files will appear under this directory, not only fast, but also the names of all files Both are original filenames.

On the other hand, a device for decrypting and obtaining evidence from files in a storage medium is provided, which is used for decrypting and extracting encrypted files in the storage medium.

The device includes: a connection module, which connects the storage media submitted for inspection, such as a U disk, to the inspection equipment through a read-only interface. During the inspection, according to the inspection regulations GB/T electronic evidence data recovery inspection regulations, all inspection materials must be kept only read.

Copy the module, use X-ways or other tool software to open the storage medium to be checked, and copy the folder Thumbs.dn to be decrypted and the mobile encryption program to the local directory in a read-only manner through the read-only interface.

Read the module, and find the key file named "117789687" in the Thumbs.dn folder, or it may be another name. The feature of this file is that it has no extension. Use X-ways to view its content as a string of letters or Combination of numbers, read the character array named 117789687 under the Thumbs.dn folder.

The conversion module converts the string array into a string according to the ASCII encoding.

The decryption module performs decryption operations on strings, and the specific operations are as follows:

First split the string, every two characters as a group, because the length of the ASCII code is 2;

For characters with odd digits, perform XOR operation with 5, because XOR operation is a bit operation, so all characters need to be converted to binary during operation, and the insufficient digits are filled with binary numbers 0;

For even-numbered characters, XOR with 4;

Save all the calculated results in a new character array in order;

Convert the array to a string in UTF8 encoding, and the result is the key.

Obtain the module, run the mobile encryption software program under the same directory as Thumbs.dn, and a window for entering the key will pop up. After entering the key, click OK, and the original files will appear under this directory. Not only is the speed fast, but the names of all files Both are original filenames.

Description of drawings

Figure 1 shows a mobile encryption program that the inventor found in the inspection materials during the inspection of the inspection materials, and later found that the software can be downloaded for free through the Internet.

Fig. 2 is a flowchart of a file decryption method in an embodiment.

Fig. 3 is a schematic structural diagram of a device capable of running the file decryption method described in this application in an embodiment.

Fig. 4 is a specific flow chart of the conversion step and the decryption step in an embodiment.

Fig. 5 is a structural diagram of a device for decrypting and extracting files in an embodiment.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The mobile encryption program interface studied in the process of the present invention is shown in Figure 1. It is a folder encryption software discovered by the inventor when inspecting materials. It exists in a large number of storage media submitted for inspection, especially in cases involving cult organizations. The embodiment is also designed for this kind of encryption software. But the present invention is not limited to this software. Because there are many similar folder encryption software on the Internet, but the encryption principle is the same.

During the invention process, the inventor conducted a lot of encryption experiments on the mobile encryption software, and finally found that the Thumbs.dn folder is the storage location of the files in the folder before encryption. By adding the system extension to change the double-click effect, My computer displays the printer icon in the control panel (double-clicking is like opening the printer in the control panel). The file structure and size of the files in this folder are basically the same as those in the storage medium before encryption, but the file name is changed, and the file as a whole or individually After exporting, you cannot directly click to view the file content. At the same time, through experiments, the inventor compared the data before and after, analyzed the encryption characteristics, and after summarizing the rules, found that the encrypted key ciphertext was stored in the "117789687" file. The inventor concluded that the encryption process has the following rules:

(1) After each character is encrypted, it is reflected in two characters in the ciphertext; (2) The same character with odd or even digits, the corresponding ciphertext is fixed; (3) The same character is located in the odd number of the plaintext Bits and even bits, the corresponding ciphertext is different;

The mobile encryption software stores the ciphertext string in the "117789687" file, and changes all the extensions of the data files to "mem" to hide them. Therefore, the encryption software does not directly encrypt the data, but encrypts the input password and hides the data files. Run this software, after entering the correct password, all files will appear in the directory where the encryption program is located soon. If you do not decrypt, you can only see the interface of adding a printer.

It is found through experiments that the encryption law is a part of the process of the present invention. This invention is also a decryption scheme designed according to the encryption law of the mobile encryption software, and for the current problems of low decryption efficiency and incomplete decrypted data, a certain method is used. The technical means solve the technical problems encountered, and achieve the technical effect of improving the inspection efficiency and ensuring the integrity of the documents.

Fig. 2 is a schematic structural diagram of a device capable of running the file decryption method described in this application in an embodiment. In one embodiment, the device includes a processor, a storage medium, memory, a display screen, and an input device connected through a system bus, and has a read-only interface that can be connected to various removable storage media such as U disk, SD card, and TF card. The input device triggers relevant instructions according to user operations, and the display screen displays relevant data information to the user. The storage medium of the device is used to store the software instructions for implementing the data extraction method described in this application and the intermediate files generated during the decryption and extraction process. The processor is used to execute these instructions, and the read-only interface is used to read the data to be decrypted in the Thumbs.

In this invention, the aforementioned hardware is an essential part of the technical solution, especially the read-only device. The verification process must always keep the storage medium in a read-only state, otherwise, once the data in the storage medium changes, the hash value will change, and the extracted data will be illegal evidence and no longer have legal efficiency.

In one embodiment, a method for decrypting and obtaining evidence from a file in a storage medium, the overall flowchart is shown in FIG. 3 , and the specific steps are as follows.

Step 301, the connection step, connect the storage medium submitted for inspection, such as a U disk, to the inspection equipment through a read-only interface. During the inspection, all inspection materials must be kept read-only in accordance with the inspection regulations GB/T Electronic Evidence Data Recovery Inspection Regulations. The purpose of keeping read-only is to not change the original data in the storage medium, so that the hash value of the storage medium will not change, which is convenient for re-inspection or supplementary inspection in the future.

Step 302, the copying step, use X-ways or other tool software to open the storage medium to be checked, copy the folder Thumbs.dn to be decrypted and the mobile encryption program to the local directory in a read-only manner through the read-only interface, and use X- Take ways as an example. The software has the function of opening the disk. After opening, you can view hidden or deleted files in the storage medium. By default, the Thumbs.dn folder is generally hidden or deleted. You need to use the software to open the file. Clips are exported from the media.

Step 303, the reading step, find the key file named "117789687" in the Thumbs.dn folder, or it may be another name. The feature of this file is that it has no extension. Use X-ways to view its content as a A combination of letters or numbers, read the character array named 117789687 under the Thumbs.dn folder, the "117789687" file is stored in the root directory of the Thumbs.dn folder, and the encrypted key is stored in the file, namely The ciphertext form of the key when stored.

Step 304, the conversion step, converts the string array into a string according to the ASCII encoding. For example, in the C# language, the method is Encoding.ASCII.GetString(), which can be called directly.

Step 305, the decryption step, performs a decryption operation on the string, the specific flow chart is shown in Figure 4, and the specific steps are subdivided as follows:

First split the string, every two characters are a group, because the length of the ASCII code is 2, so every two characters encode a character in the key;

For the character group with odd digits, XOR operation is performed with 5, because the XOR operation is a bit operation, so all characters need to be converted to binary during operation, and the insufficient digits are filled with binary numbers 0;

Here is an example to illustrate the XOR process. When the character hexadecimal characters 34 and 5 are XORed, the binary form of 34 is: 0011 0100, and the binary form of 5 is 0101. Then, 0000 must be added before 0101 during operation, that is, 00110100 ⊕00000101=00110001, converted into hexadecimal is 34⊕5=31, where ⊕ is the operator of XOR operation;

For the character group of even digits, perform XOR operation with 4; it also needs to be converted to binary form for operation;

Save all the calculated results in a new character array in order;

Convert the array to a string in UTF8 encoding, and the result is the key.

Step 306, the acquisition step, under the same directory as the exported Thumbs.dn folder, run the mobile encryption software program, a window for entering the key will pop up, click OK after entering the key, and the original files will all appear under the directory, not only The speed is fast, and the names of all files are original file names, which ensures the integrity of the files.

The document of this application also provides a device for decrypting and extracting files corresponding to the above method for decrypting and extracting files.

In one embodiment, a device for decrypting and extracting files decrypts and extracts files encrypted by mobile encryption software, as shown in Figure 5, and the specific modules are as follows.

Module 301, a connection module, connects the storage medium submitted for inspection such as a U disk to the inspection equipment through a read-only interface.

Module 302, the copy module, uses forensics software to open the storage medium to be checked, and copies the folder Thumbs.dn and the mobile encryption program to be decrypted to the local directory in a read-only manner through the read-only interface. By default, the Thumbs.dn file The folder is generally hidden or deleted. It is necessary to use X-ways and other forensics software to export the folder from the media.

Module 303, read module, find the key file named "117789687" under the Thumbs.dn folder, read the character array named 117789687 under the Thumbs.dn folder, and the "117789687" file is stored in Thumbs. Under the root directory of the dn folder, the encrypted key is stored in the file, that is, the ciphertext form of the key is stored.

Module 304, a conversion module, converts the string array into a string according to the ASCII code.

Module 305, the decryption module, performs decryption operations on character strings. The specific flow chart is shown in Figure 4, and the specific content is subdivided as follows:

First split the string, every two characters as a group;

For the character group with odd digits, XOR operation is performed with 5, because the XOR operation is a bit operation, so all characters need to be converted to binary during operation, and the insufficient digits are filled with binary numbers 0;

For the character group of even digits, perform XOR operation with 4; it also needs to be converted to binary form for operation;

Save all the calculated results in a new character array in order;

Convert the array to a string in UTF8 encoding, and the result is the key.

Module 306, acquisition module, under the same directory as the exported Thumbs.dn folder, run the mobile encryption software program, an input key window will pop up, click OK after entering the key, and the original files will all appear under this directory, not only The speed is fast, and the names of all files are original file names, which ensures the integrity of the files.

Claims (2)

1. A method of decrypting a document within a storage medium for evidence, the method comprising:

a connection step of connecting the storage medium to be inspected to the inspection apparatus through a read-only interface;

a copying step, namely opening a storage medium to be checked by using electronic evidence obtaining software, and copying a file thumb. Dn to be decrypted and a mobile encryption program to a local directory;

a reading step, namely finding a key file with a file name of 117789687 under the thumb.dn folder, and reading a character array with the file name of 117789687 under the thumb.dn folder;

a conversion step of converting the character array into a character string according to ASCII coding;

a decryption step, wherein the character string is decrypted, and the specific operation is as follows:

firstly, segmenting a character string, wherein every two characters are in a group;

performing exclusive OR operation on the odd-numbered characters and 5;

performing exclusive OR operation on the even-numbered characters and 4;

storing all the operated results in a new character array according to the sequence, converting the array into character strings in a UTF8 coding mode, and obtaining a key as the result;

and in the acquisition step, a mobile encryption software program is operated under the same directory of thumb.dn, an input key window is popped up, the point is determined after the key is input, the original files are all under the directory, the speed is high, the names of all the files are original file names, and the integrity of the data files is ensured.

2. An apparatus for decrypting a forensic document in a storage medium, the apparatus comprising:

the connection module is used for connecting the storage medium for inspection to the inspection equipment through a read-only interface;

the copying module is used for opening a storage medium to be checked by using electronic evidence obtaining software and copying a file thumb. Dn to be decrypted and a mobile encryption program to a local directory;

the reading module is used for finding a key file with a file name of 117789687 under the thumb.dn folder and reading a character array with the file name of 117789687 under the thumb.dn folder;

the conversion module converts the character array into a character string according to ASCII codes;

the decryption module is used for carrying out decryption operation on the character string, and the specific operation is as follows:

firstly, the character string is divided into two groups, and the length of ASCII codes is 2;

performing exclusive OR operation on the odd-numbered characters and 5;

performing exclusive OR operation on the even-numbered characters and 4;

storing all the operated results in a new character array according to the sequence, converting the array into character strings in a UTF8 coding mode, and obtaining a key as the result;

the acquisition module runs the mobile encryption software program under the same directory of thumb.dn, and pops up an input key window, the input key is confirmed at a later point, and the original files are all under the directory, so that the speed is high, the names of all the files are original file names, and the integrity of the data files is ensured.

Images