GA/T 1572-2019Forensic sciences - Technical specifications for examination of location information of mobile terminals (English PDF)

4.1 Hardware

Electronic physical evidence inspection workstation, mobile phone inspection workstation, electronic data storage medium duplication equipment, electronic data storage medium write protection device Devices, dedicated storage media, digital cameras, etc.

4.2 Software

4.2.1 Operating System

Windows, Unix/Linux, Mac OS, Android, iOS, etc.

4.2.2 Software tools

Data synchronization software, location reproduction software or mobile terminal simulation software, special viewing tools for system files, special viewing for user files Class tools.

5.1 Inspection material and sample number

Uniquely number the materials (samples) to be inspected.

5.2 Inspection of materials and samples

Take a photo of the sample (sample) submitted for inspection, and record the characteristics of the sample.

5.3 Data inspection

5.3.1 Equipment inspection

Equipment inspection includes at least the following.

a) It should be read-only connected to the electronic physical evidence inspection workstation or mobile phone inspection workstation through a data cable;

b) Start anti-virus software to disinfect the inspection workstation system;

c) Run the data synchronization software or forensics software, and copy the electronic data stored in the inspection materials to a dedicated storage medium.

5.3.2 Inspection of storage media

The storage media inspection shall include at least the following.

a) Connect the storage medium to the electronic physical evidence inspection workstation in a read-only manner;

b) Make a safe backup of the electronic data in the storage medium and check it according to GB/T 29362-2012 or GB/T 29360-2012 Check and obtain electronic data in the storage medium;

c) Copy the obtained electronic data files to a dedicated storage medium.

5.3.3 Inspection of Geographic Track Data Cache File

Obtain the geographic track data cache file according to the requirements of GA/T 756-2008.

a) Check the mobile terminal cache. Find the directory storage path of the operating system cache geographic track positioning data in the inspection material, and obtain the cached Geo-track data cache files and file creation time, modification time, and last access time information, and Extract the recorded location information, positioning method and positioning time from the record;

b) Verify the mobile terminal application software data. Find the number of mobile terminal application software and application software with positioning authority in the inspection material Data storage directory. Find the file containing the positioning cache data from the data storage directory of the application software, the user account information file Information about the creation time, modification time, and last access time of files and files, and extract users from the user account information file Detailed account information, extract location information, location method and location time from the location cache data file;

c) Record and verify the acquired geographic track data files, and copy the acquired electronic data files to a dedicated storage medium.

5.4 Data presentation

5.4.1 Run position reproduction software or mobile simulation software in the workstation to interpret and present the position and trajectory information recorded in the electronic data.

5.4.2 Fixed results.

5.5 Calculating the hash value

Calculates a hash of the checked out and rendered data.

7.1 Inspection information record

For inspection materials, records should include but are not limited to the following.

a) Inspection material category;

b) the type of inspection material;

c) The unique number of the inspection material at the factory (if applicable);

d) Inspection material photo.

7.2 Inspection process records

In the inspection of geographic trajectory data, the records shall run through the entire inspection process, and the records shall include but not limited to the following.

a) software and hardware tools used in the inspection process;

b) inspection content, operating conditions, data detected and presented during the process of setting up the environment;

c) The hash value calculated from the obtained geographic track data file.