物联网法医:利用HIKVISION文件系统中未开发的日志记录
Evangelos Dragonas1, Costas Lambrinoudakis1, Michael Kotsis2
1Department of Digital Systems, University of Piraeus, Attica, Greece.
Journal of forensic sciences
|August 1, 2023
概括
这项研究分析了HIKVISION CCTV日志记录,揭示了商业法医工具经常忽略的关键证据. 一个新的Python实用程序帮助数字法医检查人员分析这些有价值的HIKVISION日志.
科学领域:
- 数字法医学数字法医学
- 物联网 (IoT) 安全 安全 物联网
背景情况:
- 闭路电视监控系统是无处不在的物联网设备,对于刑事调查至关重要.
- 像HIKVISION这样的设备中的专有文件系统阻碍了全面的数字取证分析.
- 之前对HIKVISION的研究集中在视频恢复上,忽视了日志数据.
研究的目的:
- 重新访问HIKVISION文件系统,特别是检查其存储的日志记录.
- 揭示HIKVISION日志记录的结构和含义,以获得法医价值.
- 在调查中解决HIKVISION日志数据尚未开发的潜力.
主要方法:
- 对HIKVISION专有文件系统进行了深入分析.
- 详细检查日志记录结构和内容.
- 开发一个用于自动日志分析的Python实用程序.
主要成果:
- 已经彻底阐明了HIKVISION日志记录的结构和含义.
- 日志记录包含关键的调查信息,目前商业法医软件无法利用这些信息.
- 一个功能性的Python工具,Hikvision日志分析器,被创建来帮助考官.
结论:
- HIKVISION日志记录是数字证据的一个重要,未被充分利用的来源.
- 开发的Hikvision日志分析器可以提高法医调查的效率和有效性.
- 建议进一步利用专有文件系统日志用于数字取证.
相关概念视频
Leaky Scanning
5.2K
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R...
5.2K
IR Frequency Region: Fingerprint Region
940
IR spectra are divided into two main regions: the diagnostic region and the fingerprint region. The diagnostic region of the spectrum lies above 1500 cm−1. The absorptions resulting from single-bond vibrations of the N–H, C–H, and O–H stretch at higher wavenumbers and appear on the left side of the spectrum. The stretching absorptions of the C≡C and C≡N occur between 2100–2300 cm−1. In contrast, those arising from stretching absorptions of the...
940
Infrared (IR) Spectroscopy: Overview
1.9K
When electromagnetic radiation passes through a material, atoms or molecules transition from a lower to a higher energy state by absorbing radiation corresponding to the energy difference between the two states. The absorption of infrared (IR) radiation causes transitions between vibrational energy levels in a molecule. Therefore, IR spectroscopy is a useful analytical tool for determining the molecular structure of molecules.
Different compounds display unique properties due to their...
Different compounds display unique properties due to their...
1.9K
Censoring Survival Data
132
Survival analysis is a statistical method used to analyze time-to-event data, often employed in fields such as medicine, engineering, and social sciences. One of the key challenges in survival analysis is dealing with incomplete data, a phenomenon known as "censoring." Censoring occurs when the event of interest (such as death, relapse, or system failure) has not occurred for some individuals by the end of the study period or is otherwise unobservable, and it might have many different...
132
Data Reporting and Recording
4.7K
Reporting and recording are crucial in data documentation. The timely, thorough, and accurate documentation of facts is essential when recording patient data. Failure to record findings during an assessment or interpretation of a problem will result in loss of information and make the patient document unreliable. The reader is left with general impressions if the information is not specific. A recording is documenting data of the individual's health information in a traceable, secure, and...
4.7K
Legal Guidelines for Documentation
1.3K
The legal guidelines for nursing documentation are essential for ensuring accurate, professional, and ethical recording of patient care. The guidelines are discussed here:
1.3K


