GA/T 1564-2019Forensic sciences - Technical specifications for collection of electronic evidence during scene investigation (English PDF)

4.1 Hardware

Video recording equipment, electronic physical evidence site survey box, mobile phone signal shielding equipment, mobile phone shielding box (bag), mobile phone forensics equipment, simulation Equipment, security backup equipment, dedicated storage media, portable computers, printers, etc.

4.2 Software

Comprehensive forensic analysis software, mobile forensic analysis software, simulation software, online forensics software, installation-free and system registration software, etc.

5 On-site physical extraction of electronic physical evidence

5.1 Computer Evidence Extraction

5.1.1 Extraction of shutdown status

5.1.1.1 Unique identification of physical evidence.

5.1.1.2 One-to-one unique numbering of physical evidence wiring and equipment interfaces.

5.1.1.3 Take photos or videos of the scene, including information such as the brand and unique number of the physical evidence.

5.1.1.4 Draw a network topology diagram.

5.1.1.5 Remove the cables and power cables between the physical evidence equipment.

5.1.1.6 Sealed physical evidence.

5.1.2 Extraction of power-on status

5.1.2.1 Uniquely number physical evidence.

5.1.2.2 Take photos or videos of the scene and screen.

5.1.2.3 For devices with a screen saver password, the password should be obtained on site or removed using the installation-free and system-free registration software. The obtained password should be Verify and document. When the screen saver password cannot be removed, the physical evidence equipment should be turned off first, and then follow the steps 5.1.1.2 ~ 5.1.1.5.

5.1.2.4 Use online forensics software to extract volatile data online, save it in a dedicated storage medium with a unique number, and calculate, Record the hash value.

5.1.2.5 The status of hard disk partitions and file display attributes shall be checked and recorded.

5.1.2.6 For devices connected to the Internet, you should check the running browser, QQ and other software settings, and close the software to exit automatically Data function settings; if special software such as virtual machines and VPNs are running, the usage status should be recorded, and the access interactions in this environment should be recorded.

IP in networking.

5.1.2.7 Record the system time and Beijing time of physical evidence.

GA/T ××××-××××

5.1.2.8 Extract the running password-protected data, save it in a special storage medium with a unique number, and calculate, Record the hash value; record the equipment, software, and carrier with the password; obtain or cancel the password on-site, and verify and record the obtained password.

5.1.2.9 Record the data extraction path and the saved path.

5.1.2.10 The operation of closing the physical evidence equipment is as follows.

-For physical evidence that does not cause data damage when the power is cut off, the power can be cut off directly;

-For material evidence that will cause data damage by turning off the power, it should be turned off in accordance with normal procedures.

5.1.2.11 Follow steps 5.1.1.2 ~ 5.1.1.5.

5.1.2.12 Seal material evidence and special storage media.

5.2 Physical extraction of cell phone physical evidence

5.2.1 Extraction of shutdown status

5.2.1.1 Uniquely number physical evidence.

5.2.1.2 Take photos or videos of the scene, including information such as the brand and unique characteristics of physical evidence.

5.2.1.3 Obtain passwords for encryption devices and encrypted expansion memory cards. The obtained password shall be verified and recorded.

5.2.1.4 Sealed physical evidence.

5.2.2 Extraction of power-on status

5.2.2.1 Unique identification of physical evidence.

5.2.2.2 Take photos or videos of the scene and screen, including information such as the brand and unique characteristics of physical evidence.

5.2.2.3 Record the system time and Beijing time of physical evidence.

5.2.2.4 Disable various communication functions.

5.2.2.5 Cancel or obtain the password of the encryption device, encrypted expansion memory card, etc. and record it.

5.2.2.6 According to the requirements of GA/T 1069-2013, when mobile phone signal shielding equipment is turned on, mobile phone forensics equipment, Mobile forensics analysis software or screen capture to extract and fix information in mobile phones.

5.2.2.7 Use cell phone shielding box (bag) to seal physical evidence.

5.3 Physical extraction of hard disk surveillance video recorder

5.3.1 Extraction of shutdown status

Follow steps 5.1.1.1 to 5.1.1.6.

5.3.2 Extraction of power-on status

5.3.2.1 Unique identification of physical evidence.

5.3.2.2 Stop the ongoing recording operation.

5.3.2.3 Take photos or videos of the scene and screen.

GA/T ××××-××××

5.3.2.4 Record the system time and Beijing time of physical evidence.

5.3.2.5 Obtain or cancel the login password of the video surveillance system. The obtained password shall be verified and recorded.

5.3.2.6 Shut down the physical evidence equipment.

5.3.2.7 Follow steps 5.1.1.2 ~ 5.1.1.6.

5.4 Physical extraction of other electronic equipment

Perform according to 5.2.1.1 ~ 5.2.1.4.

6.1 Remote Survey Online Extraction

6.1.1 Take a picture or record the environment of the extraction operation site and use the equipment.

6.1.2 Determine the location of the remote data storage and record the domain name of the remote storage device and the IP corresponding to the domain name.

6.1.3 Login, browse the remote target device, website account, take screenshots, take photos and record the whole process of the operation process, record the login Account name, password, path, etc.

6.1.4 Perform data search according to GB/T 29362-2012, extract data content such as web pages, emails, and files from remote destinations in a unique storage medium with a unique number, the hash value of the extracted data is calculated and recorded. Take a screenshot, take a picture of the operation process Process video.

6.1.5 Record the Beijing time, place, personnel, and software and hardware information of the remote survey online extraction data.

6.1.6 Record the extracted data path and saved path.

6.1.7 Seal special storage media.

6.2 Computer and hard disk surveillance video recorder data extraction

6.2.1 All data extraction

6.2.1.1 Unique identification of physical evidence.

6.2.1.2 Take photos or videos of the scene.

6.2.1.3 The security backup operation of the built-in hard disk of physical evidence is as follows.

-The physical evidence equipment is on and is not allowed to be turned off. It should use online forensics software for security backup and record the extracted data.

Hash value, system time of physical evidence and Beijing time;

-The physical evidence equipment is in the off state or is allowed to be off. The on state should be performed according to the steps 5.1.2.3 ~ 5.1.2.10 or 5.3.2.2 ~ 5.3.2.6.

Shut down, then use the security backup device to perform a security backup, and record the hash value of the extracted data.

6.2.1.4 Uniquely number and archive the secure backup hard disk.

6.2.2 Partial data extraction

6.2.2.1 Unique identification of physical evidence.

6.2.2.2 Take photos or videos of the scene.

GA/T ××××-××××

6.2.2.3 The operation of extracting target data is as follows.

--The device is on and not allowed to shut down, you should use online forensics software and perform data search according to GB/T 29362-2012, Extract the target data online, save it in a dedicated storage medium with a unique number, and record the hash value and physical evidence of the extracted data System time and Beijing time;

--The device is in the off state or allowed to be turned off. The on state should be performed according to the steps 5.1.2.3 ~ 5.1.2.10 or 5.3.2.2 ~ 5.3.2.6.

And then connect the physical evidence storage medium to the loaded comprehensive forensic analysis through the read-only device in the electronic physical evidence site survey box Software for portable computers, using comprehensive forensic analysis software according to GB/T 29360-2012 and GB/T 29362-2012 Perform data recovery search, extract target data, save it in a dedicated storage medium with a unique number, and record the extracted data Hash value, system time of physical evidence and Beijing time;

--There are special types of files that need to be browsed using specific application software in the physical evidence equipment. Emulation equipment or security should be used.

The backup disk made by the backup device starts the physical evidence device and performs data recovery according to GB/T 29360-2012 and GB/T 29362-2012 Repeat the search, extract the target data, save it in a dedicated storage medium with a unique number, and record the hash value, System time of physical evidence and Beijing time.

6.2.2.4 Special storage media for data information shall be sealed.

6.3 Extraction of data from other electronic equipment

6.3.1 Uniquely number physical evidence.

6.3.2 Take photos or videos of the scene.

6.3.3 Connect the physical evidence to the security backup equipment or connect the physical evidence to the loaded integrated equipment through the read-only equipment in the electronic physical evidence site survey box.

Forensic analysis software on a laptop and start the forensic analysis software.

6.3.4 Use security backup equipment or comprehensive forensic analysis software to make image files or extract target data, and save it in a unique number Dedicated storage medium and records the hash value of the extracted data.

6.3.5 Seal the special storage medium for storing data information.

7 On-site records of the entire process of physical evidence and data extraction

7.1 The operation steps shall be recorded in detail.

7.2 The unique number of the physical evidence, the name of the physical evidence, the model and characteristics of the physical evidence, the spatial location where the physical evidence is located, and the special storage medium should be recorded.

Identification number, data storage path in dedicated storage media, data storage path in physical evidence equipment, software used to extract data, and Device, extract the hash value of the data.

7.3 The physical evidence and data extraction personnel shall sign the extraction records and indicate the date of extraction. When using a computer for recording, the log file is printed before it is signed.