微信证据的鉴真方法研究  

Research on Authentication Method of WeChat Evidence

作　　者：倪雪莉 王群[1,2,3] 梁广俊 NI Xueli;WANG Qun;LIANG Guangjun(Department of Computer Information and Cyber Security,Jiangsu Police Institute,Nanjing 210031,China;Jiangsu Electronic Data Forensics and Analysis Engineering Research Center,Nanjing 210031,China;Jiangsu Provincial Public Security Department Key Laboratory of Digital Forensics,Nanjing 210031,China)

机构地区：[1]江苏警官学院计算机信息与网络安全系,南京210031 [2]江苏省电子数据取证分析工程研究中心,南京210031 [3]江苏省公安厅数字取证重点实验室,南京210031

出　　处：《信息网络安全》2021年第12期60-69,共10页Netinfo Security

基　　金：江苏省高校自然科学研究重大项目[20KJA520004]。

摘　　要：近年来,微信证据在庭审中出现的频率越来越高,与传统证据相比,微信证据由于主体和内容的虚拟性,其真实性常常受到质疑。现有的微信证据审查实践缺乏明确的流程规范且鉴真技术尚不完善,针对这一现状,基于微信账户的特征及微信数据库的存储加密原理,文章提出一种针对微信证据的鉴真取证模型,该模型结合法律维度,从主体的认证、消息的完整性确认、消息内容的鉴真等方面着手,覆盖证据的固定保全、分析鉴定全流程,体现了程序规则与技术措施的有效结合。通过引入微信索引库比对技术进行微信消息的篡改检测实验,验证了该模型的正确性和可行性。In recent years, WeChat evidence appears increasingly frequently in the court trial.Compared with the traditional evidence, the authenticity of WeChat evidence is questioned due to the virtuality of the subject and content. The existing WeChat evidence review practice lacks clear rules and the distinguishing technology is not perfect. Based on the characteristics of WeChat account and the storage and encryption principles of WeChat database, this paper proposed an authentication model for WeChat evidence. The model creatively combined legal dimensions with the authentication of the subject, the integrity of the message, the authentication of the content and so on. Furthermore, this model covered the whole process of evidence preservation, analysis and identification. It reflected the effective combination of procedural rules and technical measures.Finally, the tamper detection experiment of WeChat messages based on WeChat Index database is carried out to verify the correctness and feasibility of the model.

关 键 词：微信证据 鉴真模型 SQLite数据库加密技术 电子数据取证 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]