JP6963764B2 - Digital Evidence Creation Device, Digital Evidence Creation Program and Digital Evidence Creation Method - Google Patents

Description

The present invention relates to a digital evidence-creating device, a digital evidence-creating program, and a digital evidence-creating method. And how to create digital evidence.

In recent years, with the development of communication environments such as the Internet environment, the penetration rate of information processing devices such as personal computers, smartphones, and tablet terminals has dramatically increased. For this reason, the number of cases in which the data recorded in the information processing device is used as evidence material in investigations and trials is increasing, and the recording medium of the information processing device is preserved in a form in which legal evidence capacity is recognized, and the legal evidence is obtained. Technology (digital forensics) that duplicates and analyzes data on recording media while maintaining evidence capacity is becoming important.

Conventionally, data recorded in an information processing device is generally recorded on an auxiliary recording medium such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a USB memory, and such an auxiliary recording medium. The technique described in Patent Document 1 is known as a technique for duplicating the data recorded in the above document in a form having legal evidence ability.

In the technique described in Patent Document 1, the target recording device in which the original data of evidence is recorded is removed from the information processing device and duplicated using a dedicated copying device, or a special OS (Operating System) dedicated to digital forensics is used. ) Is used to activate the information processing device for duplication.

In addition, although it is not a technique related to the stage of data duplication, Patent Document 2 describes the operation status of a digital forensic worker's PC at predetermined time intervals with a video camera in order to prevent intentional data falsification. A worker who analyzes the work video log data generated by shooting and the analysis HDD that is a physical 100% copy of the HDD to be investigated digitally operates a PC with built-in software for digital forensic work. Systems or methods have been proposed to prove the validity of operation records in forensic work.

Japanese Unexamined Patent Publication No. 2006-178521 Japanese Unexamined Patent Publication No. 2008-216342

In the digital forensic technology described in Patent Document 1 described above, a state in which the OS installed in the information processing device is started by using a special OS so that the OS installed in the information processing device is not started from the state in which the power of the information processing device is turned off. Data is being duplicated at.

In the normal OS installed in the information processing device, some input such as operation and communication is performed, and startup (including restart) and termination (including temporary stop such as sleep and suspend) are performed. If it is damaged, a part of the information recorded in the auxiliary recording device (time stamp, etc.) is automatically rewritten, and when the data is accessed to read the data of the auxiliary recording device, the data itself is changed. This is because there is a risk of degrading the original evidence.

However, with the development of the communication environment in recent years, cloud computing has become common, in which work data and application programs are stored on the Internet, and work data and application programs are downloaded from the Internet as needed. There is. In particular, in smartphones, tablet computers, etc., various data are stored in the cloud, and there is a problem that appropriate evidence preservation cannot be performed when the connection with the Internet is cut off.

Moreover, since smartphones and tablet computers are designed on the assumption that the power is always on and the Internet is always connected, data that is digital evidence may be lost once the terminal is turned off. .. This applies not only to application data, but also to malicious programs and unauthorized access where the preservation of digital evidence is important. That is, malicious programs and unauthorized access may stop their activities when the power is turned off or the Internet connection is disconnected, and traces of malicious programs being executed on the terminal or traces of unauthorized access are the terminals. It may disappear from the inside.

For this reason, it is necessary to collect evidence while connected to the Internet without turning off the power, but even while collecting digital evidence, there is a possibility that automatic data rewriting or deletion will occur because the power is always on. There is always the possibility that data will be rewritten, updated, deleted, etc. by communication via the Internet.

From such a situation, the digital forensic method of starting in a state where data rewriting does not occur using a special OS as described in Patent Document 1 described above is a constantly power-on state of a smartphone, a tablet computer, or the like. , It could not be used for digital forensics of terminals that are always connected to the Internet.

The present invention has been made in view of the above problems, and enables the creation of digital evidence having legal evidence capability from a communication terminal that is premised on constant power-on and constant Internet connection, and more preferably, such a communication terminal. The purpose is to avoid requiring technical expertise from workers involved in digital evidence creation work.

One aspect of the present invention is a display unit and an operation unit, a first image pickup unit capable of imaging the display unit and the operation unit, and a second image pickup capable of imaging the display unit and the operation unit of a communication terminal. and parts, and a connecting portion to which the communication terminal during startup and operation at available Internet communication is connected, the operation recording creation unit that creates an operation record for the communication terminal and the digital evidence creation device, before Symbol communication terminal comprising an acquisition unit for acquiring digital evidence, the respectively generated operation record and the hash of said digital evidence, a recording unit for recording the hash to the recording medium together with the digital evidence and the operation record, from the previous SL When the communication terminal can be connected to the connection unit, the operation record creation unit creates the operation of the operation unit by the operator who creates the digital evidence imaged by the first image pickup unit as the operation record. the acquisition unit, front Symbol connecting portion is displayed before Symbol display unit a screen capture image of the communication terminal by controlling the communication terminal via the display a predetermined operation is performed with respect to the operation portion When the screen capture image displayed on the unit is acquired as the digital evidence and the communication terminal cannot be connected to the connection unit, the operation record creation unit performs the digital evidence captured by the second imaging unit. The operation of the operation unit of the communication terminal by the worker who creates the image is created as the operation record, and the acquisition unit captures a screen capture image of the display unit of the communication terminal captured by the second imaging means. It is a digital proof creation device characterized by acquiring a screen capture image displayed on the display unit as the digital proof when a predetermined operation is performed on the operation unit.

In the digital evidence creation device configured in this way, the operation record creation unit records the process of connecting the communication terminal to the connection unit and the acquisition unit acquiring digital evidence from the communication terminal via the connection unit. The acquired digital evidence and the created operation record are recorded in the recording unit together with the hash value. That is, while making it possible to verify that there is no illegal operation in the process of acquiring digital evidence based on the operation record, it is proved by the hash value that the operation record and the digital evidence have not been tampered with.

One of the selective aspects of the present invention is to connect the communication terminal, which is activated and operating in a state where Internet communication is possible, to the connection unit, so that the acquisition unit can connect the communication terminal via the connection unit. It is a digital proof creation device characterized by controlling and acquiring a screen capture image of an application using cloud computing of the communication terminal as the digital proof.

In the digital evidence creation device configured in this way, since digital evidence is acquired in a state where Internet communication is possible, even an application placed on the cloud can operate on a communication terminal, and also. Even data placed on the cloud can be read and displayed in the application. That is, a screen capture image of an application using cloud computing can be acquired and saved as digital evidence.

In the digital evidence creation device configured in this way, while displaying the screen capture image acquired from the communication terminal on the display unit at a certain moment, the operation of directly looking at the screen of the communication terminal and instructing the acquisition of the screen capture image is performed. Instead of performing the operation, the operation of instructing the acquisition of the screen capture image by looking at the screen capture image displayed on the display unit is performed. This makes it possible to acquire the screen capture image as digital evidence without looking at the screen of the communication terminal, and the communication terminal instructed to acquire the screen capture image by the operation of the operation unit actually obtains the screen capture image. It is possible to substantially eliminate the time lag until the image is created.

In one of the selective aspects of the present invention, the acquisition unit controls the communication terminal via the connection unit to scroll the screen of the communication terminal while displaying a plurality of screen-captured images as the digital evidence. A digital proof-creating device, which is characterized by being acquired as a digital proof-creating device.

In the digital evidence creating device configured in this way, the screen of the application having the vertically long or horizontally long scroll screen can be divided into a plurality of screen capture images and acquired.

One of the selective aspects of the present invention is digital, wherein the acquisition unit controls the communication terminal via the connection unit to acquire device-specific information of the communication terminal as the digital evidence. It is an evidence creation device.

In the digital evidence creating device configured in this way, since the device information of the communication terminal is acquired as digital evidence via the connection portion and recorded on the recording medium together with the hash value, the communication terminal at the time when the digital evidence is acquired. It becomes possible to identify the state of.

One of the other aspects of the present invention is a digital evidence creation program executed in a digital evidence creation device , which is a connection unit and a display unit to which a communication terminal activated / operating in a state where Internet communication is possible is connected. And the operation unit, the first image pickup unit capable of imaging the display unit and the operation unit, the second image pickup unit capable of imaging the display unit and the operation unit of the communication terminal, the communication terminal and the digital evidence. An operation record creation function for creating an operation record of a creation device , an acquisition function for acquiring digital evidence from the communication terminal, a hash of the operation record and the digital evidence are generated, and the hash is used as the operation record and the digital. When a recording function for recording on a recording medium together with evidence is provided and the communication terminal can be connected to the connection unit, the operation record creation function is an operation of creating digital evidence imaged by the first imaging unit. The operation of the operation unit by a person is created as the operation record, and the acquisition function controls the communication terminal via the connection unit to display a screen capture image of the communication terminal on the display unit, and the operation. When a predetermined operation is performed on the unit, the screen capture image displayed on the display unit is acquired as the digital evidence, and when the communication terminal cannot be connected to the connection unit, the operation record creation function Creates the operation of the operation unit of the communication terminal by the operator who creates the digital evidence imaged by the second imaging unit as the operation record, and the acquisition function is the image captured by the second imaging unit. The screen capture image of the display unit of the communication terminal is displayed on the display unit, and when a predetermined operation is performed on the operation unit, the screen capture image displayed on the display unit is acquired as the digital evidence. It is a featured digital evidence creation program.

One of the other aspects of the present invention is a digital proof creation method for creating digital proof using a digital proof creation device , which is a connection unit to which a communication terminal activated and operating in a state where Internet communication is possible is connected. A display unit and an operation unit, a first imaging unit capable of imaging the display unit and the operation unit, a second imaging unit capable of imaging the display unit and the operation unit of the communication terminal, and the communication terminal. And the operation record creation step of creating the operation record of the digital evidence creation device , the acquisition step of acquiring the digital evidence from the communication terminal, the operation record and the hash of the digital evidence are generated, respectively, and the hash is used as the operation. In the recording step of recording and recording on a recording medium together with the digital evidence, and when the communication terminal can be connected to the connection unit, the operation record creation step creates digital evidence imaged by the first imaging unit. The operation of the operation unit by the operator is created as the operation record, and in the acquisition step, the communication terminal is controlled via the connection unit to display a screen capture image of the communication terminal on the display unit. When a predetermined operation is performed on the operation unit, the screen capture image displayed on the display unit is acquired as the digital evidence, and when the communication terminal cannot be connected to the connection unit, the operation record is created. In the step, the operation of the operation unit of the communication terminal by the operator who creates the digital evidence imaged by the second imaging unit is created as the operation record, and the acquisition step is imaged by the second imaging unit. The screen capture image of the display unit of the communication terminal is displayed on the display unit, and when a predetermined operation is performed on the operation unit, the screen capture image displayed on the display unit is acquired as the digital evidence. It is a digital evidence creation method characterized by.

The digital evidence creating device according to the present invention includes various aspects such as being carried out in a state of being incorporated in another device or being carried out in combination with another method. In addition, the digital evidence creation program according to the present invention includes an embodiment in which the program is recorded as a recording medium. In addition, the digital evidence creation method according to the present invention includes various aspects such as being implemented as a part of other methods or being realized as an apparatus or system provided with means corresponding to each process.

According to the present invention, it is possible to create digital evidence having legal evidence capability from a communication terminal that is premised on constant power-on and constant Internet connection.

In addition , since digital evidence is acquired while Internet communication is possible, applications placed on the cloud can also operate on communication terminals, and data placed on the cloud is also read and displayed in the application. be able to. That is, the screen capture image of the display screen of the application using cloud computing can be acquired and saved as digital evidence.

In addition , while displaying the screen capture image acquired from the communication terminal at a certain moment on the display unit, the screen capture image is displayed on the display unit instead of directly looking at the screen of the communication terminal and instructing the acquisition of the screen capture image. The operation of instructing the acquisition of the screen capture image by looking at the screen capture image is performed. This makes it possible to acquire the screen capture image as digital evidence without looking at the screen of the communication terminal, and the communication terminal instructed to acquire the screen capture image by the operation of the operation unit actually obtains the screen capture image. It is possible to substantially eliminate the time lag until the image is created.

Further , the screen of the application having the vertically long or horizontally long scroll screen can be divided into a plurality of screen capture images and acquired.

Further , since the device information of the communication terminal is acquired as digital evidence via the connection unit and recorded on the recording medium together with the hash value, the state of the communication terminal at the time when the digital evidence is acquired can be specified.

It is a figure explaining the digital evidence making apparatus. It is a figure which shows the functional structure of the digital evidence making apparatus. It is a figure which shows the outline of the digital evidence making work using a digital evidence making apparatus. This is a concrete example of the license screen. It is a figure which shows an example of the main menu. It is a figure which shows an example of "setting screen". It is a figure which shows an example of "ADB editor". It is a figure which shows an example of "case creation screen". It is a figure which shows an example of "Android (registered trademark) device selection screen". It is a figure which shows an example of "digital evidence creation menu". It is a figure which shows an example of the "device information screen". It is a figure which shows an example of "content maintenance screen". It is a figure which shows an example of "content maintenance completion screen". It is a figure which shows an example of the display which recognizes that content preservation is in progress. It is a figure which shows an example of the "screenshot screen". It is a figure which shows an example of "a moving image and a still image screen". It is a figure which shows an example of "ADB command selection screen". This is a modified example of the device configuration of the digital evidence creation device. This is a modified example of the device configuration of the digital evidence creation device.

FIG. 1 is a diagram illustrating a digital evidence creation device. The figure shows an information processing device such as a personal computer as the digital evidence creating device 100.

The digital evidence creation device 100 includes a display 10, a keyboard 11, a touch pad 12, a microphone 13, and USB (Universal Serial Bus) connectors 14 to 17.

The USB connector 14 is connected to a dongle DG, which will be described later. The USB connector 15 is used as a connection unit for connecting the smart phone 200 as a communication terminal from which digital evidence is created. In the present embodiment, when the specific display, control, and the like are explained, the explanation will be given by taking a mobile phone terminal on which the Android (registered trademark) OS is installed as an example of the smartphone 200. The camera 25 is connected to the USB connector 16. The camera 20 as one of the operation record creating units is connected to the USB connector 17. The cameras 20 and 25 may use the built-in camera of the digital evidence creating device 100, and in FIG. 1, the cameras 20 and 25 are shown as a part of the digital evidence creating device 100. Further, the microphone is not limited to the built-in microphone of the digital evidence creating device 100, and an externally connected microphone may be used.

The digital evidence creation program PG executed by the digital evidence creation device 100 requires the attachment of the dongle DG to the digital evidence creation device 100 as a condition for normal operation. That is, the dongle DG functions as a protection dongle of the digital evidence creation program PG executed by the digital evidence creation device 100. When the dongle DG is not attached, the digital evidence creation program PG displays, for example, a message that the dongle DG cannot be started, the function is restricted, or the guarantee of the legal evidence ability of the digital evidence to be created is not guaranteed.

The camera 20 is used to create a moving image as one of the operation records of the operation of the worker (hereinafter, simply referred to as the worker) who creates digital evidence for the smartphone 200 and the digital evidence creation device 100. Will be done.

The camera 25 is used for shooting a moving image or a still image of the screen display of the smartphone 200 taken from the outside. The shooting of a moving image or a still image by the camera 25 is used when it is difficult to take a screenshot obtained by controlling the smart phone 200 described later. This difficult case may be a case where it is technically difficult to take a screenshot of the smart phone from the outside, or a case where the owner of the smart phone is reluctant to create digital evidence by connecting a communication cable.

FIG. 2 is a diagram showing a functional configuration of the digital evidence creating device according to the present embodiment.

The digital evidence creating device 100 shown in the figure includes a control unit F11, a display unit F12 including the above-mentioned display 10 and its control function, a above-mentioned keyboard 11 and a touch pad 12, an operation unit F13 including its control function, and the above-mentioned USB. It includes an input / output unit F14 including connectors 14 to 17 and their control functions, and a recording unit F15.

The digital evidence creation program PG is recorded in the recording unit F15, and the control unit F11 is composed of an arithmetic processing unit, a work memory, and the like for executing the digital evidence creation program PG. In the present embodiment, the recording unit F15 also constitutes a storage area for storing digital evidence, and also stores digital evidence DC, which will be described later.

The smart phone 200 includes a control unit F21, a display unit F22 including a display 210 and its control functions, an operation unit F23 including a touch screen 211 and its control functions, a connector 213 to which a communication cable C1 is connected, and an input including its control functions. It includes an output unit F24, a recording unit F25, and a communication unit F26. The smart phone 200 is communicably connected to the digital evidence creating device 100 via the communication cable C1.

The operating system of the smartphone 200 and various applications are recorded in the recording unit F25, and the recording unit F25 may be configured not only in the internal storage but also in the external storage, or may be configured by a combination thereof. The control unit F21 is composed of an arithmetic processing unit, a work memory, and the like for executing programs of an operating system and various applications. The operation unit F23 is not limited to the configuration using the touch screen, and various devices such as a keyboard that accept the operation input of the user can be adopted. The communication unit F26 connects to the Internet In via a wireless LAN (Local Area Network) line or a communication network of a mobile phone carrier to perform communication.

Various application programs are pre-installed or additionally installed in the recording unit F25 of the smart phone 200, and cloud computing that operates using data and programs on the Internet is used in such application programs. There is something to do. In addition, the operating system of the smart phone 200 itself may have a function using cloud computing. Hereinafter, the program in the smartphone 200 using these cloud computings will be referred to as a CC program.

The CC program always assumes an internet connection, and it cannot be executed when the internet connection is cut off, it is executed with some functions restricted, or some or all of the data stored in the cloud is stored. It may be executed in a state where it cannot be displayed. As a CC program, for example, there is a chat application, and all or part of the conversation data constituting the timeline of the chat application is data stored in the cloud.

Next, the flow of digital evidence creation will be described. FIG. 3 is a diagram showing an outline of digital evidence creation work using a digital evidence creation device.

In the digital evidence creation work, first, the dongle DG is connected to the digital evidence creation device 100, and the digital evidence creation program PG is executed (S1). When the digital evidence creation program PG detects the connection of the dongle DG, it starts normally in a state where the creation of digital evidence can be executed, but when the connection of the dongle DG cannot be detected, it does not start, or the digital evidence creation function. Starts in a restricted state.

Next, set the environment for setting the camera and microphone used to create digital evidence (S2). In the present embodiment, the camera 20 is selected and set as the camera for shooting the moving image, which is one of the operation records, the camera 25 is selected and set as the camera for shooting the screen display of the smartphone 200, and the sound of the moving image is recorded. Select and set the microphone 13 as the microphone.

Next, the case name, which is the identification information of the digital evidence, and the attributes and characteristics of the communication terminal are registered (S3). Any number, symbol, code, or character string can be used as the case name, and the creators of digital evidence, analysts, institutions that use digital evidence, and other related parties can use multiple digital evidences. It suffices if the case name can be identified from the evidence as a clue. As the attributes and characteristics of the digital evidence, various information indicating the hardware environment, software environment, and communication environment of the smartphone 200 can be adopted. At the same time, in this step S2, a case folder CF as a storage area for storing the digital evidence of the present case is created in the recording unit F15 of the digital evidence creation device 100.

Next, after starting the creation of the operation record (the moving image of the operation and the operation log recording the operation performed via the operation unit F13) (S4), the smart phone 200 is connected to the digital evidence creating device 100. Then, the digital evidence creation device 100 recognizes the smart phone 200 (S6). When the preparation for creating digital evidence is complete, various digital evidences are acquired from the smartphone 200 and stored in the case folder CF described above (S7), and when the creation of digital evidence is completed, the smartphone The 200 is removed from the digital evidence creating device 100 (S8), and the creation of the operation record is completed (S9).

As described above, the operation record creation start timing is before the time when the smart phone 200 is connected to the digital evidence creation device 100, and the operation record is continuously created after the time when the digital evidence creation is completed. .. All operations performed directly on the smart phone 200 or indirectly via the digital evidence creation device 100 are recorded in the recording unit F25 as moving images and operation logs, and are intentionally or unintentionally recorded during the digital evidence creation work. It can be proved based on at least one of the moving image and the operation log that no illegal operation is performed.

Hereinafter, a more specific example of the flow of digital evidence creation using the digital evidence creation device 100 will be described.

When the dongle DG is connected to the digital evidence creation device 100 and the digital evidence creation program PG is started, for example, a license screen for presenting the software license agreement shown in FIG. 4 is displayed on the display 10. When the operator inputs an operation that agrees to the software license agreement, the "main menu" of the digital evidence creation program PG is displayed on the display 10. FIG. 5 is a diagram showing an example of the “main menu”.

In the "main menu" shown in FIG. 5, operation items of "maintenance execution", "ADB editor", and "environment setting" are arranged. When the operator inputs an operation to select "environment setting" in this "main menu", a "setting screen" for selecting a camera and a microphone to be used for digital evidence preservation is displayed on the display 10. FIG. 6 is a diagram showing an example of a “setting screen”.

In the "setting screen" shown in FIG. 6, the "operation recording camera" is an operation item for selecting a camera for creating an operation record, and in the configuration example shown in FIG. 1, the camera 20 is selected. The “screen recording camera” is an operation item for selecting a camera for capturing a moving image or a still image displayed on the screen of the smartphone 200, and in the configuration example shown in FIG. 1, the camera 25 is selected. The “operation recording microphone” is an operation item for selecting a microphone that records voice in conjunction with a camera that creates an operation record, and in the configuration example shown in FIG. 1, the microphone 13 is selected. When the operation item of "Registration" is operated, the selection contents of each item are applied and then returned to the main menu, and when the operation item of "Cancel" is operated, the selection contents of each item are not applied and the main menu is returned.

When the operator inputs an operation to select the "ADB editor" in the "main menu" shown in FIG. 5, the "ADB editor" shown in FIG. 7 is displayed on the display 10. In the "ADB editor", a desired ADB (Android (registered trademark) Debug Bridge) command can be registered, and the registered command can be called and used from "ADB execution and maintenance" described later.

Specifically, in the "command name" input field, enter a name that can identify the ADB command to be registered. In each input field of "carrier information", "maker", and "Android (registered trademark) OS", the mobile phone carrier name, manufacturer name, and Android (registered trademark) OS of the smartphone to which the ADB command to be registered is applied. Enter the version of each. In the "execution command" input field, enter a desired ADB command or a series of ADB commands together with various arguments. In the "command information" input field, enter a description of the ADB command to be registered, if necessary. If you operate the "Register" operation item, you will register the ADB command with the contents entered in each input field and return to the main menu, and if you operate the "Cancel" operation item, you will return to the main menu without registering the ADB command.

In the "ADB editor", not only a single ADB command but also a series of a plurality of ADB commands and their arguments can be registered as batch processing.

When the operator inputs an operation to select "maintenance execution" in the "main menu" shown in FIG. 5, the process for creating digital evidence of the smart phone 200 is started. When the creation of digital evidence is started, the "case creation screen" is first displayed. On the case creation screen, enter properties that indicate the characteristics and attributes of the case for which digital evidence preservation is performed. FIG. 8 is a diagram showing an example of a “case creation screen”.

In the "case creation screen" shown in FIG. 8, in the "case name" input field, the above-mentioned information that can identify the digital evidence is input. In "Case save destination", select the folder to create the digital evidence storage folder. In the "Person in charge" input field, enter the name, identification code, etc. of the person in charge of preserving this digital evidence. In the item of "maintenance date and time", the current system time held by the digital evidence creating device 100 is displayed. Regarding the item of "maintenance date and time", the date and time corrected by the worker may be used in the creation of digital evidence. In the "Presence / absence of pass lock" input field, select whether or not the smartphone 200 has a pass lock. If there is a pass lock, in the comment field, specify the passcode and passcode heard from the owner of the smartphone 200. Enter the application name, etc. used. In the "Presence / absence of rooting" input field, select whether or not to root the smartphone 200, and if there is rooting, the software name used for rooting or the smartphone used for rooting heard from the owner of the smartphone 200. If the worker roots after obtaining 200 as evidence, enter the name of the software used for the rooting, the reason for rooting, etc. in the comment field as necessary. In the "Insert SIM" input field, select whether or not to insert the SIM of the smartphone 200. In the input field of "terminal network setting", select whether the network setting of the smartphone 200 is valid or invalid. In the "Case content" input field, enter additional information such as the reason for each property as necessary. Various inputs on the "case creation screen" are performed without connecting the smart phone 200 to the digital evidence creation device 100. When the operation item of "Next" is operated, the "Android (registered trademark) device selection screen" is displayed, and when the operation item of "Cancel" is operated, the screen returns to the "Main menu".

In addition, on the "case creation screen", input "case name", "case save destination" and "person in charge name", and "presence / absence of path lock", "presence / absence of rooting", "insert SIM". And the selection of "terminal network setting" is a required input element, and the operation item of "next" on the "case creation screen" cannot be operated until all of these required input elements are input. Also, if you select "with or without pass lock" with pass lock, or if you select "with or without rooting" with rooting, you must enter in each comment field, and each comment field is blank. During that time, the operation items of "Next" on the "Case creation screen" cannot be operated.

When the operation item of "Next" is operated on the "Case creation screen" shown in FIG. 8, the creation of digital evidence according to the property entered in each input field is started, and the operation item of "Cancel" is operated. Then, it returns to the "main menu". When the operation item of "Next" is operated, specifically, in the folder specified in "Case save destination", the case folder CF whose folder name is the matter identification information entered in "Case name" is created. Recording of the created moving image and the moving image taken by the camera 20 is started. This video is saved in the case folder CF. Hash values (SHA256, MD5, etc.) are generated in the digital evidence and the operation record stored in the case folder CF, respectively, and the hash values are recorded in association with the digital evidence from which the hash values are created. For example, in the case folder CF, correspondence table data recorded by associating the file path of the digital evidence with the hash value is created.

FIG. 9 is a diagram showing an example of an “Android (registered trademark) device selection screen”. In the "Android (registered trademark) device selection screen", the digital evidence creating device 100 recognizes the Android (registered trademark) device that is the source of digital evidence. If you check "Preserve evidence" in "Video and still image" and operate the operation item of "Next", in the "Digital evidence creation menu" shown in FIG. 10 to be described later, "Device information", Items such as "content preservation", "screenshot", and "ADB execution and preservation" are grayed out and cannot be selected.

Specifically, first, the smart phone 200 is connected to the digital evidence creation device 100 with the communication cable C1, the operation item of "device recognition" is operated, and the smart phone 200 is selected from the devices displayed in the device list. .. When the smart phone 200 is selected in this way and the operation item of "Next" is operated, the "Digital Evidence Creation Menu" is displayed. On the other hand, if you operate the "Back" operation item, you will return to the "Case creation screen", and if you operate the "Cancel" operation item, you will return to the "Main menu".

If the smartphone 200 is not displayed in the device list on the "Android (registered trademark) device selection screen", install the driver for the smartphone 200 on the digital evidence creation device 100 and select "USB debugging settings" for the smartphone 200. Do at least one of the activations. If you enable "USB debugging settings", you can debug the Smartphone 200 from a computer connected with a USB cable. The digital evidence creation device 100 holds drivers for a plurality of smartphones that support digital evidence creation in advance, and is configured to automatically install the drivers when a smartphone for which the drivers have not been installed is connected. ing. Further, when the operation item of "USB debugging setting method" is operated on the "Android (registered trademark) device selection screen", an explanation screen of the operation to be performed when the USB debugging setting is enabled on the smartphone is displayed.

After the "Android (registered trademark) device selection screen" to which the smart phone 200 is connected, the operation input performed by the user to the digital evidence creation device 100 via the operation unit F13 of the digital evidence creation device 100 is the operation time. It is recorded one by one in the operation log as one of the operation records together with the information, and this operation log is saved in the case folder CF. A hash value is also generated and recorded for this operation log. In addition, the contents entered on the "case creation screen" and the information acquired in each operation item of the digital evidence creation menu described later are also recorded in the evidence log together with the acquisition time information, and the case folder CF is recorded as one of the digital evidence DCs. Saved in. As a specific example of the items recorded in the evidence log for each operation item of the digital evidence creation menu described later, "device information" is displayed on the "device information screen", and "content preservation" is preserved. For "screenshot" such as file name, file path before maintenance, file path after maintenance, file size, etc., screen capture creation conditions (conditions set in each operation item of "screenshot screen"), screen capture For "video and still image" such as the file name and file path after saving, the conditions for creating a video or still image (conditions set in each operation item of "video and still image screen"), created video or still image. Regarding "ADB execution and maintenance" such as the file name of the image and the file path after saving, the contents of the executed ADB command (conditions set in each operation item of "ADB execution and maintenance" and command information of the executed ADB command And the execution command and the execution log.

FIG. 10 is a diagram showing an example of a “digital evidence creation menu”. The "Digital Evidence Creation Menu" contains operation items such as "Device Information", "Content Preservation", "Screenshots", "Videos and Still Images", "ADB Execution and Preservation", and "Return to Main Menu". It is displayed.

When the operation item of "device information" is operated, the "device information screen" that displays a list of device information of the smartphone 200 is displayed. FIG. 11 is a diagram showing an example of a “device information screen”.

In FIG. 11, as the device information of the smartphone 200 displayed on the “device information screen”, the manufacturer name, model name, brand name, OS version, BaseBand version, build number, IMEI ( International Mobile Equipment Identity), with or without rooting, internal storage capacity, available internal storage, external memory card storage capacity, available external memory card storage, SIM (Subscriber Identity Module) carrier. These device information can be obtained by using the ADB command. In this way, it is possible to comprehensively collect information about the smartphone 200 by inputting into each input field of the "case creation screen" and device information automatically acquired by operating the operation item of "device information". can.

When you operate the operation item of "Content preservation", the "Content preservation screen" for saving the duplicate of the content saved in the internal storage of the smartphone 200 and the storage of the memory card in the case folder CF is displayed. NS. FIG. 12 is a diagram showing an example of a “content preservation screen”.

The content preservation target can be selected from "memory card only", "internal storage only", and "all including the system". The selection item of "internal storage only" may be "memory card / internal storage only". In content preservation, a hash value is generated and recorded for each content data. A file whose existence has been confirmed but cannot be preserved is saved with a capacity of 0 KB. When you operate the operation item of "Start maintenance", the maintenance of the contents is started, and the progress of the maintenance work is displayed on the pro / O less bar of the elapsed time. If you operate the "Cancel" operation item, you will return to the "Digital Evidence Creation Menu". When the content maintenance is completed, for example, as shown in FIG. 13, a completion screen for displaying the number of errors, elapsed time, maintenance filter, maintenance destination, and the like is displayed.

In "content preservation", the content preservation application APK is sent from the digital evidence creation program PG to the smartphone 200 to be installed and executed. The content preservation application APK collects content data in the smartphone 200 and transmits it to the digital evidence creation device 100. At this time, the content preservation application APK invalidates the operation on the smart phone 200, and displays the screen of the smart phone 200 to recognize that the content is being preserved (in FIG. 14, the case name and the person in charge). ) Is desirable. The content preservation application APK is uninstalled from the smartphone 200 by the ADB command from the digital evidence creation program PG after the content preservation is completed.

When the operation item of "Screenshot" is operated, the "Screenshot screen" for saving the screenshot of the screen of the smartphone 200 in the case folder CF is displayed. FIG. 15 is a diagram showing an example of a “screenshot screen”.

The "screenshot screen" is a display area that displays a duplicate of the screen of the smartphone 200, a case display area that displays case information, a vertical / horizontal switching unit that switches the screen of the smartphone 200 displayed in the display area vertically and horizontally, and an aspect of the display area. Aspect ratio switching unit for switching ratios, scroll method selection unit for selecting the scroll method (manual / automatic) when performing screen capture of an application with a scroll screen, scroll direction for screen capture of an application with a scroll screen (manual / automatic) Select the number of screen captures to be continuously acquired when "Automatic" is selected in the scroll direction switching unit that switches up / down / left / right direction, and the scroll method selection unit. Set the scroll width adjustment part for adjusting the scroll amount from the display screen at the time of screen capture to the display screen at the next screen capture, and whether to enable mouse / keyboard operation on the preview screen. It has a direct operation setting unit and a thumbnail display area for displaying a list of captured screen capture image thumbnails.

When the operation item of "Start screen capture" is operated, the screen of the smartphone 200 displayed in the display area is captured and saved together with the hash value in the case folder CF.

When automatic scrolling is selected in the scroll method selection section, after performing screen capture, the scroll direction is automatically scrolled by a certain amount in the scroll direction set in the scroll direction switching section to perform the next screen capture, and this is the scroll screen. Repeat until the start or end of the scroll direction is reached. Whether or not the start or end has been reached can be determined, for example, by comparing the last screen capture and the previous screen capture and based on the presence or absence of changes between these screen captures. Further, in the screen capture by automatic scrolling, the next screen capture is performed by automatically scrolling a certain amount of scroll adjusted by the scroll width adjusting unit in the scroll direction set by the scroll direction switching unit. In automatic scrolling, the scroll amount when scrolling once is set to a unique default value for each model of the smartphone 200, and the amount corresponding to the entire scroll direction of the smartphone 200 screen is set. Often. In this case, if automatic scrolling is performed with the default scroll amount, the hidden portion by the bars B1 and B2 (see FIG. 15) set at the upper edge and the lower edge of the application program display screen is not captured in the screen capture image. There is. Further, depending on the model of the smart phone 200, the default scroll amount may be set to about half of the entire scroll direction of the screen of the smart phone 200. In addition, in the digital evidence creation policy, in order to secure evidence showing the continuity between the previous screen capture image and the next screen capture image, for example, in the case of a chat application, the image was captured in the previous screen capture image. There may be a requirement that the last line of the timeline overlap with the first line of the timeline captured in the next screen capture image, that is, the presence of a certain amount of overlap. In such a case, by operating the scroll width adjustment unit to adjust the scroll amount for one scroll in automatic scrolling, the hidden parts of bars B1 and B2 are removed from the overall size of the screen of the smartphone 200 in the scroll direction. It is possible to set the scroll amount and adjust so that the immediately preceding screen capture image and the next screen capture image have a certain amount of overlap or more. The operation for the scroll width adjustment unit can also be performed during the execution of screen capture by automatic scrolling, and the screen of the smartphone 200 that scrolls and is sequentially displayed in the display area during the execution of screen capture by automatic scrolling. You can adjust the scroll amount so that the scroll width is appropriate while observing the scroll amount of the duplicate. When you operate the operation item of "Stop screen capture", the screen capture performed while automatically scrolling is stopped. If you select anything other than "Unlimited" in the number of shots selection section, automatic scrolling and shooting will be performed when the acquisition of screen captures for the set number of shots is completed, regardless of whether the start or end of the scroll direction has been reached. Automatically stop. If you operate the "Cancel" operation item, you will return to the "Digital Evidence Creation Menu". When manual scrolling is selected in the scroll method selection unit, the screen of the smartphone 200 at that time is screen-captured. When manual scrolling is selected, in order to perform screen capture of other screens of the smartphone 200, you can directly operate the screen of the smartphone 200 or check the direct operation setting section described above to display the display area. By performing mouse / keyboard operations, the screen transitions to another screen of the smart phone 200. A series of screen captures created by automatic scrolling are sorted and saved in individual folders created with a unique name (for example, a combination of date and time) each time automatic scrolling is executed. This makes it easier to distinguish between screen captures created by other automatic scrolling and screen captures created by manual scrolling, and the discrimination of evidence is improved.

The screen of the smart phone 200 can be remotely operated from the operation unit F13 of the digital evidence creating device 100. For example, clicking on the screen of the smart phone 200 in the display area may be a tap operation, or some keys of the keyboard may be associated with the buttons of the smart phone 200 so that the terminal can be operated from the keyboard. Specifically, if the direct operation setting unit is checked, the mouse / keyboard operation via the display area is enabled, and if the direct operation unit is unchecked, the mouse / keyboard operation via the display area is disabled. When mouse / keyboard operation is enabled, for example, when a mouse operation is performed on a duplicate of the screen of the smartphone 200 displayed in the display area, an operation equivalent to a touch operation on the screen of the smartphone 200 is executed, and the display area is displayed. When is activated and the keyboard is operated, the screen transition of the smart phone 200 is performed according to the cursor key operation, and the character input is performed according to the character key operation. That is, the mouse operation or keyboard operation performed on the display area produces the same operation result as the operation performed via the touch screen or operation buttons of the smart phone 200. As a result, the smart phone 200 can be operated without directly touching the smart phone 200.

When the operation item of "moving image and still image" is operated, the moving image or still image taken by the camera 25 is created, and the "moving image and still image screen" for saving with the hash value is displayed in the case folder CF. FIG. 16 is a diagram showing an example of a “moving image and still image screen”.

The "video and still image screen" includes a preview display area for displaying the preview of the camera 25, a case display area for displaying case information, a vertical / horizontal switching unit for switching the preview vertically and horizontally, and an aspect ratio switching unit for switching the aspect ratio of the preview display area. A telop input field for inputting thumbnails (arbitrary numbers, character strings, symbols, etc.) to be overlaid on a video or still image, a shooting method switching unit that switches the shooting method between video and still images, and shooting timing when shooting still images It has a shooting timing setting unit for manually specifying or automatically and periodically shooting, and a thumbnail display area for displaying a list of thumbnails of shot moving images or still images.

When shooting a still image manually, when the operation item of "Start recording" is operated, shooting is performed and the shot image is saved together with the hash value in the case folder CF. When shooting a still image automatically, the shooting is started by operating the operation item of "recording start", and the shooting is repeatedly executed periodically until the operation item of "recording stop" is operated. When shooting a moving image, shooting is started by operating the operation item of "start recording", and shooting is ended by operating the operation item of "stop recording". The captured still image or moving image is stored in the case folder CF together with the hash value. The above-mentioned telop is superimposed on the captured moving image or still image. If you operate the "Cancel" operation item, you will return to the "Digital Evidence Creation Menu".

When the operation item of "ADB execution and maintenance" is operated, the "ADB command selection screen" is displayed. From the "ADB command selection screen", the ADB command registered in the "ADB editor" of the main menu can be called and executed. As a result, even ordinary workers can create advanced digital evidence by packaging and registering ADB commands, even for the creation of advanced digital evidence that could only be done by workers with high technical expertise in the past. Will be able to do. FIG. 17 is a diagram showing an example of the “ADB command selection screen”.

The "ADB command selection screen" is provided with a carrier selection unit, a manufacturer selection unit, an Android (registered trademark) OS selection unit, a command selection unit, a command information display unit, an execution command display unit, and an execution log display unit. When a carrier, manufacturer, and Android (registered trademark) OS is selected in each selection unit, the commands that can be selected in the command selection unit are narrowed down to those that can be used in the selected carrier, manufacturer, and Android (registered trademark) OS. When a desired command is selected in the command selection unit, the command information of the command is displayed in the command information display unit, and the execution command is displayed in the execution command display unit.

When you operate the operation item of "Execution", the selected ADB command is executed, the execution result is displayed in the execution log display area, and when the command that generates a file is executed, it is in the case folder CF. Stored with the hash value. If you operate the "Cancel" operation item, you will return to the "Main Menu". Depending on the command, permission for execution may be requested on the screen of the smartphone 200, and it may be necessary to perform an operation for permitting execution on the smartphone 200.

According to the digital evidence creating device described above, the camera 20 has taken a picture of the process of connecting the smart phone 200 to the USB connector 17 and acquiring the digital evidence DC from the smart phone 200 via the USB connector 17, and acquired the digital evidence DC. The digital evidence DC and the captured moving image are recorded in the recording unit F15 together with the hash value. That is, it is possible to verify with a moving image that there is no illegal operation or the like in the process of acquiring the digital evidence DC, and it is possible to prove with a hash value that the moving image and the digital evidence DC have not been tampered with.

In addition, since the digital evidence DC is acquired in a state where Internet communication is possible, the application placed on the cloud can also be operated by the smartphone 200, and the data placed on the cloud is also read into the application. Can be displayed.
That is, the screen capture image of the display screen of the application using cloud computing can be acquired and saved as digital evidence DC.

Also, instead of displaying the screen capture image acquired from the smartphone 200 on the "screenshot screen" at a certain moment and directly looking at the screen of the smartphone 200 to instruct the acquisition of the screen capture image, " You can perform an operation to instruct the acquisition of the screen capture image by looking at the screen capture image displayed on the "screenshot screen". As a result, it is possible to perform an operation of acquiring the screen capture image as a digital evidence DC without looking at the screen of the smart phone 200, and the smart phone 200 instructed to acquire the screen capture image by operating the operation unit F13. The time lag until the screen capture image is actually created can be substantially eliminated.

Further, the screen of the application having the vertically long or horizontally long scroll screen can be divided into a plurality of screen capture images and acquired.

Further, since the device information of the smart phone 200 is acquired as the digital evidence DC via the USB connector 17 and recorded on the recording medium together with the hash value, the state of the smart phone 200 at the time when the digital evidence DC is acquired can be specified. ..

It should be noted that the above-described embodiment can be modified and implemented as shown in FIGS. 18 and 19. 18 and 19 are digital evidence creating devices as a modification of the device configuration. That is, as shown in FIG. 18, the digital evidence creating device may be configured not to be provided with the camera 20 used for creating a moving image of the operation status of the operator. Further, as shown in FIG. 19, the digital evidence creation device may be realized by reading the digital evidence creation program PG from an external storage medium such as a CD-ROM.

It should be noted that the present invention is not limited to the above-described embodiment, and is disclosed in the configurations in which the configurations disclosed in the above-described embodiments are replaced with each other or the combinations are changed, known techniques, and the above-described embodiments. It also includes configurations in which the configurations are replaced with each other or the combinations are changed. Further, the technical scope of the present invention is not limited to the above-described embodiment, but extends to the matters described in the claims and their equivalents.

10 ... Display, 11 ... Keyboard, 12 ... Touch Pad, 13 ... Microphone, 14 ... USB Connector, 15 ... USB Connector, 16 ... USB Connector, 17 ... USB Connector, 20 ... Camera, 25 ... Camera, 100 ... Digital Evidence Creation Equipment, 200 ... Smartphone, 210 ... Display, 211 ... Touch screen, 213 ... Connector, Apk ... Content preservation application, B1, B2 ... Bar, C1 ... Communication cable, CF ... Case folder, DC ... Digital evidence, DG ... Dongle, F11 ... Control unit, F12 ... Display unit, F13 ... Operation unit, F14 ... Input / output unit, F15 ... Recording unit, F21 ... Control unit, F22 ... Display unit, F23 ... Operation unit, F24 ... Input / output unit, F25 ... Recording Department, F26 ... Communication Department, In ... Internet, PG ... Digital Evidence Creation Program

Claims (6)

Display and operation units
A first imaging unit capable of imaging the display unit and the operation unit, and
A second imaging unit that can image the display and operation units of the communication terminal,
A connecting portion to which the communication terminal during start-up and operation in the Internet communication capable state is connected,
An operation record creation unit that creates operation records for the communication terminal and the digital evidence creation device, and
An acquisition unit for acquiring digital evidence from prior Symbol communication terminal,
A recording unit that generates a hash of the operation record and the digital evidence, and records the hash together with the operation record and the digital evidence on a recording medium .
Equipped with a,
Wherein when communication terminal can be connected before Symbol connecting portion,
The operation record creation unit
The operation of the operation unit by the operator who creates the digital evidence imaged by the first imaging unit is created as the operation record.
The acquisition unit,
To display the screen capture image of the communication terminal by controlling the communication terminal via the front Symbol connecting portion before Symbol display unit, are displayed on the display unit and the predetermined operation is performed on the operation unit Obtain the screen capture image as the digital proof
If the communication terminal cannot be connected to the connection unit,
The operation record creation unit
The operation of the operation unit of the communication terminal by the operator who creates the digital evidence imaged by the second imaging unit is created as the operation record.
The acquisition unit
The screen capture image of the display unit of the communication terminal captured by the second imaging means is displayed on the display unit, and when a predetermined operation is performed on the operation unit , the screen capture displayed on the display unit is performed. A digital proof-creating device, characterized in that an image is acquired as the digital proof. By connecting the communication terminal that is activated and operating in a state where Internet communication is possible to the connection unit, the acquisition unit controls the communication terminal via the connection unit to perform cloud computing of the communication terminal. The digital proof creation device according to claim 1, wherein a screen capture image of the used application is acquired as the digital proof. The acquisition unit is characterized in that it controls the communication terminal via the connection unit and acquires a plurality of the screen capture images as the digital evidence while scrolling the screen of the communication terminal. The digital evidence creation device according to claim 2. The method according to any one of claims 1 to 3, wherein the acquisition unit controls the communication terminal via the connection unit to acquire device information of the communication terminal as the digital evidence. Digital evidence creation device. A digital evidence-making program that runs on a digital evidence-making device.
The connection part to which the communication terminal that is started and operating in the state where Internet communication is possible is connected,
Display and operation units
A first imaging unit capable of imaging the display unit and the operation unit, and
A second imaging unit capable of imaging the display unit and the operation unit of the communication terminal, and
An operation record creation function for creating operation records of the communication terminal and the digital evidence creation device, and
The acquisition function to acquire digital evidence from the communication terminal and
A recording function that generates hashes of the operation record and the digital evidence, respectively, and records the hashes on a recording medium together with the operation record and the digital evidence.
Equipped with a,
When the communication terminal can be connected to the connection part,
The operation record creation function is
The operation of the operation unit by the operator who creates the digital evidence imaged by the first imaging unit is created as the operation record.
The acquisition function
The screen captured image of the communication terminal is displayed on the display unit by controlling the communication terminal via the connection unit, and the screen displayed on the display unit when a predetermined operation is performed on the operation unit. Obtain the captured image as the digital evidence and
If the communication terminal cannot be connected to the connection unit,
The operation record creation function is
The operation of the operation unit of the communication terminal by the operator who creates the digital evidence imaged by the second imaging unit is created as the operation record.
The acquisition function
The screen capture image of the display unit of the communication terminal captured by the second imaging unit is displayed on the display unit, and when a predetermined operation is performed on the operation unit, the screen capture displayed on the display unit is performed. A digital proof creation program characterized by acquiring an image as the digital proof. It is a digital evidence creation method that creates digital evidence using a digital evidence creation device.
The connection part to which the communication terminal that is started and operating in the state where Internet communication is possible is connected,
Display and operation units
A first imaging unit capable of imaging the display unit and the operation unit, and
A second imaging unit capable of imaging the display unit and the operation unit of the communication terminal, and
An operation record creation process for creating an operation record of the communication terminal and the digital evidence creation device, and
The acquisition process for acquiring digital evidence from the communication terminal,
A recording step of generating a hash of the operation record and the digital evidence, respectively, and recording the hash together with the operation record and the digital evidence on a recording medium.
When the communication terminal can be connected to the connection part,
The operation record creation process is
The operation of the operation unit by the operator who creates the digital evidence imaged by the first imaging unit is created as the operation record.
The acquisition process is
The screen captured image of the communication terminal is displayed on the display unit by controlling the communication terminal via the connection unit, and the screen displayed on the display unit when a predetermined operation is performed on the operation unit. Obtain the captured image as the digital evidence and
If the communication terminal cannot be connected to the connection unit,
The operation record creation process is
The operation of the operation unit of the communication terminal by the operator who creates the digital evidence imaged by the second imaging unit is created as the operation record.
The acquisition process is
The screen capture image of the display unit of the communication terminal captured by the second imaging unit is displayed on the display unit, and when a predetermined operation is performed on the operation unit, the screen capture displayed on the display unit is performed. A method for creating digital evidence, which comprises acquiring an image as the digital evidence.

Images