2024“龙信杯“电子数据取证竞赛——计算机取证题目Writeup

以下内容是2024年“龙信杯”电子数据取证竞赛计算机取证题目的答案与解题思路

前置

前置发现电脑中有EFS加密文件，故使用仿真软件保持原有密码进行仿真

1.分析计算机检材，嫌疑人在将其侵公数据出售前在Pycharm中进行了AES加密，用于加密的key是多少？[标准格式：1A23456ABCD]

参考答案：65B2564BG89F16G9
解题思路：使用仿真软件对计算机检材进行仿真，打开桌面Pycharm软件，发现encrypted.py脚本，定位key值。

2.分析计算机检材，身份证为"371963195112051505"这个人的手机号码是多少？[标准格式：13013524420]

参考答案：15075547510
解题思路：
2.1根据key"65B2564BG89F16G9"、iv"83E6CBEF547944CF"对身份证"371963195112051505"进行加密

在线加密地址：https://www.mklab.cn/utils/aes

2.2 在文件中搜索对应值，解密当行其他值

3.分析计算机检材，对解密后的身份证数据列进行单列去重操作，重复的身份证号码数量是多少？(身份证不甄别真假)[标准格式：100]

参考答案：0
解题思路：
3.1 对加密文件“encrypted_data.txt”进行解密，编写代码如下：

import os 
import
time 
from Crypto.Cipher import AES 
from
Crypto.Util.Padding import unpad 
from concurrent.futures import
ProcessPoolExecutor, as_completed 
from tqdm import tqdm defaes_decrypt(encrypted_data, key, iv): cipher =AES.new(key, AES.MODE_CBC, iv) decrypted_data =cipher.decrypt(encrypted_data) unpadded_data =unpad(decrypted_data, AES.block_size) returnunpadded_data.decode("utf-8")defprocess_chunk(lines, key, iv): result =[] for line inlines: parts =line.strip().split(',')index = parts[0]decrypted_parts = [index] for part inparts[1:]:encrypted_part = bytes.fromhex(part)decrypted_part =aes_decrypt(encrypted_part, key, iv) decrypted_parts.append(decrypted_part) result.append(",".join(decrypted_parts)+ "\n")return result defget_file_line_count(file_path): withopen(file_path, 'r', encoding='utf-8')
as f: line_count = sum(1for _ inf) return line_countdefprocess_data(input_file, output_file, key, iv, num_workers=32,
chunk_size=10000):total_lines =get_file_line_count(input_file) num_workers =min(num_workers, os.cpu_count() * 2)withProcessPoolExecutor(max_workers=num_workers)
as executor, \ open(input_file, "r")
as f_in, \ open(output_file, "w")
as f_out: futures = [] lines_processed = 0pbar = tqdm(desc="解密进度",
unit="行",
total=total_lines)try:whileTrue:lines =[f_in.readline() for _ inrange(chunk_size)]lines =list(filter(None, lines))if notlines: break future =executor.submit(process_chunk, lines, key, iv) futures.append((future, len(lines)))forfuture, num_lines in futures: iffuture.done(): result =future.result() f_out.writelines(result) lines_processed += num_lines pbar.update(num_lines) futures.remove((future, num_lines)) exceptKeyboardInterrupt:print("\n用户中断操作。")except Exceptionas e: print(f"处理数据时发生错误:{e}")finally:for future, num_lines infutures: try:result =future.result() f_out.writelines(result) lines_processed +=num_lines pbar.update(num_lines) except Exceptionas e: print(f"处理剩余任务时发生错误:{e}")pbar.close() print(f"解密完成。共解密{lines_processed}行数据。")if__name__ =='__main__':key =b'65B2564BG89F16G9'iv =b'83E6CBEF547944CF'input_file= "../encrypted_data.txt"output_file = "decrypted_data.txt"start_time = time.time() print("开始解密...")try:process_data(input_file, output_file, key, iv, num_workers=64)except Exceptionas e: print(f"处理数据时发生错误:{e}")end_time = time.time() print(f"总耗时:{end_time -start_time} 秒")

3.2 使用EmEditor对身份证列进行去重操作

4.分析计算机检材，接上题，根据身份证号码（第17位）分析性别，男性的数据是多少条？[标准格式：100]

参考答案：5001714
解题思路：
4.1根据身份证的特性（第17位）来判断男性还是女性，其中奇数分配给男性，偶数分配给女性，编写代码如下：

import threading
from tqdm import tqdm 
import os defread_file_with_encoding(file_path, encoding): try:with open(file_path, 'r',
encoding=encoding) as file:return file.readlines()except UnicodeDecodeError:return None defprocess_line(line): try:_, _, id_number, _, original_gender =line.strip().split(',')exceptValueError:print(f"数据格式错误:{line.strip()}")return None iflen(id_number) == 18:gender_digit = id_number[16] # 第17位(0-based index)ifgender_digit.isdigit(): analyzed_gender ='男' ifint(gender_digit) % 2!= 0 else'女'else:print(f"身份证号码格式错误:{id_number}")return None else:print(f"身份证号码长度错误:{id_number}")return None returnf"{analyzed_gender},{original_gender}\n"defworker(lines, results, lock, pbar): local_results =[] for line inlines: result =process_line(line) ifresult: local_results.append(result) pbar.update(1)withlock: results.extend(local_results) defmain(): file_path ='decrypted_data.txt'ifnot os.path.exists(file_path): print(f"文件{file_path}不存在，请检查文件路径。")return lines =read_file_with_encoding(file_path, 'utf-8')if lines isNone:lines =read_file_with_encoding(file_path, 'gbk')if lines isNone:return total_entries = len(lines)num_threads = 8chunk_size = total_entries //num_threads threads = [] results = [] lock =threading.Lock() pbar =tqdm(total=total_entries, desc="处理进度",
unit="条")for i inrange(num_threads):start =i * chunk_size end =None ifi == num_threads -1 else(i + 1) *chunk_size thread =threading.Thread(target=worker,
args=(lines[start:end], results, lock,
pbar))threads.append(thread) thread.start() forthread in threads: thread.join() pbar.close() withopen('result.txt', 'w',
encoding='utf-8')
as outfile: forline in results: outfile.write(line) print("数据分析和写入result.txt 完成。")if__name__ =='__main__':main()

4.2 分析上述生成的result.txt文件，编写代码如下：

import os defcount_males_in_result(file_path): male_count =0withopen(file_path, 'r', encoding='utf-8')
as infile: for linein infile: analyzed_gender, _ =line.strip().split(',')if analyzed_gender =='男':male_count += 1return male_count defmain(): result_file_path ='result.txt'ifnotos.path.exists(result_file_path): print(f"文件{result_file_path}不存在，请先生成结果文件。")return male_count =count_males_in_result(result_file_path) print(f"第一列数据中男性数量为:{male_count}")if__name__ =='__main__':main()

5.分析计算机检材，接上题，对解密后的数据文件进行分析，甄别身份证号码性别值与标识性别不一致的数量是多少？[标准格式：100]

参考答案：5001185
解题思路：
分析上述生成的result.txt文件，编写代码如下：

import os 
from
tqdm import tqdm defcount_mismatched_entries(file_path): mismatch_count =0total_entries =0withopen(file_path, 'r', encoding='utf-8')
as infile: for linein tqdm(infile, desc="Counting
mismatched entries"):analyzed_gender,
original_gender =line.strip().split(',')total_entries += 1if analyzed_gender !=original_gender: mismatch_count +=1returnmismatch_count, total_entries defmain(): result_file_path ='result.txt'ifnotos.path.exists(result_file_path): print(f"文件{result_file_path}不存在，请先生成结果文件。")return mismatch_count, total_entries =count_mismatched_entries(result_file_path) print(f"不一致的数据量为:{mismatch_count}，总数据量为:{total_entries}")if__name__ =='__main__':main()