095_数字取证高级技术：区块链取证与加密货币追踪实战指南——从交易分析到智能合约漏洞的全面取证方法

# 区块链数据结构示例
class Block:
    def __init__(self, index, previous_hash, timestamp, transactions, hash, nonce=None):
        self.index = index  # 区块索引
        self.previous_hash = previous_hash  # 前一个区块的哈希值
        self.timestamp = timestamp  # 时间戳
        self.transactions = transactions  # 交易列表
        self.hash = hash  # 区块哈希值
        self.nonce = nonce  # 工作量证明的随机数

class Transaction:
    def __init__(self, txid, inputs, outputs, timestamp, fee=None):
        self.txid = txid  # 交易ID
        self.inputs = inputs  # 输入列表
        self.outputs = outputs  # 输出列表
        self.timestamp = timestamp  # 时间戳
        self.fee = fee  # 交易费用

class Input:
    def __init__(self, previous_txid, vout, script_sig, sequence=None):
        self.previous_txid = previous_txid  # 前一个交易的ID
        self.vout = vout  # 前一个交易的输出索引
        self.script_sig = script_sig  # 解锁脚本
        self.sequence = sequence  # 序列值

class Output:
    def __init__(self, value, script_pubkey, address=None):
        self.value = value  # 金额
        self.script_pubkey = script_pubkey  # 锁定脚本
        self.address = address  # 接收地址（如果可解析）

# 比特币交易图构建示例
import networkx as nx
import matplotlib.pyplot as plt

def build_transaction_graph(tx_data):
    """构建比特币交易图"""
    G = nx.DiGraph()
    
    for tx in tx_data:
        tx_id = tx['txid']
        
        # 添加交易节点
        G.add_node(tx_id, type='transaction', value=sum(out['value'] for out in tx['vout']))
        
        # 处理输入
        for i, vin in enumerate(tx['vin']):
            if 'coinbase' not in vin:  # 跳过coinbase交易
                prev_tx = vin['txid']
                prev_out_index = vin['vout']
                
                # 添加输入连接
                input_address = get_address_from_tx_output(prev_tx, prev_out_index)
                if input_address:
                    G.add_edge(input_address, tx_id, type='input', index=i)
        
        # 处理输出
        for i, vout in enumerate(tx['vout']):
            output_address = get_address_from_script_pubkey(vout['scriptPubKey'])
            if output_address:
                G.add_node(output_address, type='address')
                G.add_edge(tx_id, output_address, type='output', index=i, value=vout['value'])
    
    return G

def get_address_from_script_pubkey(script_pubkey):
    """从脚本公钥中提取地址"""
    # 简化实现，实际需要解析不同类型的脚本公钥
    if 'addresses' in script_pubkey and script_pubkey['addresses']:
        return script_pubkey['addresses'][0]
    return None

def get_address_from_tx_output(tx_id, output_index):
    """获取交易输出对应的地址"""
    # 实际实现需要查询区块链数据
    # 这里简化处理
    return f"address_from_{tx_id}_{output_index}"

# 示例使用
# tx_data = fetch_transactions(['address1', 'address2'])  # 假设函数获取交易数据
# graph = build_transaction_graph(tx_data)
# nx.draw(graph, with_labels=True, node_size=100)
# plt.show()

# 地址聚类示例算法
from collections import defaultdict

def cluster_addresses(tx_data):
    """基于共同输入启发法聚类比特币地址"""
    # 构建地址到交易的映射
    address_to_txs = defaultdict(set)
    tx_to_addresses = defaultdict(set)
    
    # 分析每笔交易
    for tx in tx_data:
        tx_id = tx['txid']
        input_addresses = []
        
        # 收集输入地址
        for vin in tx['vin']:
            if 'coinbase' not in vin:  # 跳过coinbase交易
                prev_tx = vin['txid']
                prev_out_index = vin['vout']
                address = get_address_from_tx_output(prev_tx, prev_out_index)
                if address:
                    input_addresses.append(address)
        
        # 如果交易有多个输入地址，它们可能属于同一实体
        if len(input_addresses) > 1:
            tx_to_addresses[tx_id].update(input_addresses)
            for addr in input_addresses:
                address_to_txs[addr].add(tx_id)
    
    # 使用并查集进行聚类
    parent = {}
    rank = {}
    
    def find(u):
        if parent[u] != u:
            parent[u] = find(parent[u])
        return parent[u]
    
    def union(u, v):
        u_root = find(u)
        v_root = find(v)
        
        if u_root == v_root:
            return
        
        if rank[u_root] < rank[v_root]:
            parent[u_root] = v_root
        elif rank[u_root] > rank[v_root]:
            parent[v_root] = u_root
        else:
            parent[v_root] = u_root
            rank[u_root] += 1
    
    # 初始化
    all_addresses = set()
    for addresses in tx_to_addresses.values():
        all_addresses.update(addresses)
    
    for addr in all_addresses:
        parent[addr] = addr
        rank[addr] = 0
    
    # 合并相关地址
    for addresses in tx_to_addresses.values():
        addresses = list(addresses)
        for i in range(1, len(addresses)):
            union(addresses[0], addresses[i])
    
    # 生成聚类
    clusters = defaultdict(list)
    for addr in all_addresses:
        clusters[find(addr)].append(addr)
    
    return dict(clusters)

# 使用Python bitcoinlib库进行简单分析示例
from bitcoinlib.transactions import Transaction
from bitcoinlib.services.services import Service

# 初始化服务
svc = Service()

# 获取地址信息
def analyze_address(address, max_txs=10):
    results = {
        'address': address,
        'balance': None,
        'transaction_count': None,
        'recent_transactions': [],
        'input_addresses': set(),
        'output_addresses': set()
    }
    
    try:
        # 获取地址信息
        address_info = svc.getaddressinfo(address)
        results['balance'] = address_info.get('balance')
        results['transaction_count'] = address_info.get('tx_count')
        
        # 获取交易历史
        txs = svc.getaddresstransactionids(address, limit=max_txs)
        
        for txid in txs:
            # 获取交易详情
            tx = svc.gettransaction(txid)
            tx_data = {
                'txid': txid,
                'block_height': tx.get('block_height'),
                'date': tx.get('date'),
                'value_in': sum(vin['value'] for vin in tx.get('inputs', [])),
                'value_out': sum(vout['value'] for vout in tx.get('outputs', [])),
                'fee': tx.get('fee')
            }
            
            results['recent_transactions'].append(tx_data)
            
            # 提取相关地址
            for vin in tx.get('inputs', []):
                if 'address' in vin:
                    results['input_addresses'].add(vin['address'])
            
            for vout in tx.get('outputs', []):
                if 'address' in vout:
                    results['output_addresses'].add(vout['address'])
    
    except Exception as e:
        print(f"分析地址 {address} 时出错: {e}")
    
    return results

# 使用示例
# address = '1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa'  # 比特币创世地址
# results = analyze_address(address)
# print(f"地址: {results['address']}")
# print(f"余额: {results['balance']} BTC")
# print(f"交易数: {results['transaction_count']}")
# print(f"输入地址数: {len(results['input_addresses'])}")
# print(f"输出地址数: {len(results['output_addresses'])}")

# 以太坊交易分析示例
from web3 import Web3

# 连接以太坊节点
w3 = Web3(Web3.HTTPProvider('https://mainnet.infura.io/v3/YOUR_INFURA_KEY'))

def analyze_ethereum_transaction(tx_hash):
    """分析以太坊交易"""
    try:
        # 获取交易详情
        tx = w3.eth.get_transaction(tx_hash)
        
        # 获取区块信息
        block = w3.eth.get_block(tx['blockNumber'])
        
        # 获取交易收据
        receipt = w3.eth.get_transaction_receipt(tx_hash)
        
        # 构建分析结果
        analysis = {
            'tx_hash': tx_hash,
            'block_number': tx['blockNumber'],
            'timestamp': block['timestamp'],
            'from_address': tx['from'],
            'to_address': tx['to'],
            'value': w3.from_wei(tx['value'], 'ether'),
            'gas_price': w3.from_wei(tx['gasPrice'], 'gwei'),
            'gas_used': receipt['gasUsed'],
            'status': receipt['status'],
            'is_contract_interaction': bool(tx['input'] != '0x'),
            'logs': []
        }
        
        # 分析事件日志
        for log in receipt['logs']:
            log_data = {
                'address': log['address'],
                'topics': [topic.hex() for topic in log['topics']],
                'data': log['data']
            }
            analysis['logs'].append(log_data)
        
        # 如果是合约交互，尝试解码输入数据
        if analysis['is_contract_interaction']:
            analysis['input_data'] = tx['input']
            # 实际解码需要合约ABI
            # analysis['decoded_input'] = decode_input_data(tx['input'], contract_abi)
        
        return analysis
        
    except Exception as e:
        print(f"分析交易 {tx_hash} 时出错: {e}")
        return None

# 使用示例
# tx_hash = '0x88df016429689c079f3b2f6ad39fa052532c56795b733da78a91ebe6a713944b'  # 示例交易哈希
# analysis = analyze_ethereum_transaction(tx_hash)
# if analysis:
#     print(f"交易哈希: {analysis['tx_hash']}")
#     print(f"发送方: {analysis['from_address']}")
#     print(f"接收方: {analysis['to_address']}")
#     print(f"价值: {analysis['value']} ETH")
#     print(f"是否合约交互: {analysis['is_contract_interaction']}")

# 以太坊代币交易分析示例
import json

def analyze_token_transfers(token_address, start_block=0, end_block=None):
    """分析代币转账交易"""
    # ERC-20 转账事件签名
    transfer_topic = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'
    
    # 获取事件过滤器
    if end_block is None:
        end_block = w3.eth.block_number
    
    # 创建事件过滤器
    event_filter = w3.eth.filter({
        'address': token_address,
        'topics': [transfer_topic],
        'fromBlock': start_block,
        'toBlock': end_block
    })
    
    # 获取事件日志
    events = event_filter.get_all_entries()
    
    transfers = []
    for event in events:
        log = event['data']
        topics = event['topics']
        
        # 解析事件数据
        from_address = '0x' + topics[1].hex()[-40:]
        to_address = '0x' + topics[2].hex()[-40:]
        value = int(log, 16)  # 代币数量，通常需要除以decimals
        
        transfer = {
            'block_number': event['blockNumber'],
            'transaction_hash': event['transactionHash'].hex(),
            'from_address': from_address,
            'to_address': to_address,
            'value': value,
            'timestamp': None  # 需要额外查询区块时间戳
        }
        
        transfers.append(transfer)
    
    # 按区块号排序
    transfers.sort(key=lambda x: x['block_number'])
    
    return transfers

# 使用示例
# usdt_address = '0xdAC17F958D2ee523a2206206994597C13D831ec7'  # Tether合约地址
# recent_transfers = analyze_token_transfers(usdt_address, end_block=w3.eth.block_number)
# print(f"找到 {len(recent_transfers)} 笔USDT转账")
# for transfer in recent_transfers[:5]:
#     print(f"从 {transfer['from_address']} 转到 {transfer['to_address']}，数量: {transfer['value']}")

# 智能合约分析示例（使用mythril工具的API调用）
import json
import subprocess

def analyze_smart_contract(contract_address):
    """使用Mythril分析智能合约漏洞"""
    try:
        # 使用mythril命令行工具分析合约
        # 实际使用需要安装mythril：pip install mythril
        result = subprocess.run(
            ['myth', 'analyze', contract_address, '--json', '--solc-json', '{"optimizer": {"enabled": true}}'],
            capture_output=True,
            text=True,
            timeout=300  # 设置超时，防止分析时间过长
        )
        
        # 解析结果
        if result.returncode == 0:
            findings = json.loads(result.stdout)
            
            # 整理发现的问题
            vulnerabilities = []
            for finding in findings:
                vuln = {
                    'title': finding.get('title'),
                    'description': finding.get('description'),
                    'severity': finding.get('severity'),
                    'address': finding.get('address'),
                    'swc_id': finding.get('swc-id')
                }
                vulnerabilities.append(vuln)
            
            return {
                'contract_address': contract_address,
                'vulnerabilities': vulnerabilities,
                'total_issues': len(vulnerabilities)
            }
        else:
            print(f"Mythril分析失败: {result.stderr}")
            return None
            
    except Exception as e:
        print(f"分析合约 {contract_address} 时出错: {e}")
        return None

# 使用示例
# contract_address = '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'  # USDC合约地址
# analysis = analyze_smart_contract(contract_address)
# if analysis:
#     print(f"合约 {analysis['contract_address']} 分析结果:")
#     print(f"发现 {analysis['total_issues']} 个潜在问题")
#     for vuln in analysis['vulnerabilities']:
#         print(f"- {vuln['title']} (严重性: {vuln['severity']})")

# 使用Web3.py进行以太坊数据分析
import pandas as pd
import numpy as np
from datetime import datetime

def analyze_address_activity(address, days=30):
    """分析以太坊地址的活动模式"""
    # 计算起始区块（简化计算，假设平均每天6500个区块）
    current_block = w3.eth.block_number
    start_block = current_block - (days * 6500)
    
    # 获取发送的交易
    sent_txs = w3.eth.get_transactions_by_account(address, 'sent', start_block, current_block)
    
    # 获取接收的交易
    received_txs = w3.eth.get_transactions_by_account(address, 'received', start_block, current_block)
    
    # 分析发送交易
    sent_analysis = {
        'count': len(sent_txs),
        'total_value': sum(w3.from_wei(tx['value'], 'ether') for tx in sent_txs),
        'total_fee': sum(w3.from_wei(tx['gasPrice'] * tx['gas'], 'ether') for tx in sent_txs),
        'unique_recipients': len(set(tx['to'] for tx in sent_txs if tx['to'])),
        'daily_activity': defaultdict(int)
    }
    
    # 分析接收交易
    received_analysis = {
        'count': len(received_txs),
        'total_value': sum(w3.from_wei(tx['value'], 'ether') for tx in received_txs),
        'unique_senders': len(set(tx['from'] for tx in received_txs)),
        'daily_activity': defaultdict(int)
    }
    
    # 时间模式分析
    for tx in sent_txs + received_txs:
        block = w3.eth.get_block(tx['blockNumber'])
        date = datetime.fromtimestamp(block['timestamp']).strftime('%Y-%m-%d')
        
        if tx['from'].lower() == address.lower():
            sent_analysis['daily_activity'][date] += 1
        else:
            received_analysis['daily_activity'][date] += 1
    
    # 活动时间模式
    active_dates = sorted(set(sent_analysis['daily_activity'].keys()) | set(received_analysis['daily_activity'].keys()))
    activity_pattern = []
    
    for date in active_dates:
        pattern = {
            'date': date,
            'sent_count': sent_analysis['daily_activity'].get(date, 0),
            'received_count': received_analysis['daily_activity'].get(date, 0),
            'total_count': sent_analysis['daily_activity'].get(date, 0) + received_analysis['daily_activity'].get(date, 0)
        }
        activity_pattern.append(pattern)
    
    return {
        'address': address,
        'time_period': f"{days}天",
        'sent_transactions': sent_analysis,
        'received_transactions': received_analysis,
        'total_transactions': len(sent_txs) + len(received_txs),
        'activity_pattern': activity_pattern,
        'is_active': len(sent_txs) + len(received_txs) > 0
    }

# 使用示例
# address = '0xde0b295669a9fd93d5f28d9ec85e40f4cb697bae'  # Ethereum Foundation地址
# analysis = analyze_address_activity(address)
# print(f"地址: {analysis['address']}")
# print(f"总交易数: {analysis['total_transactions']}")
# print(f"发送交易: {analysis['sent_transactions']['count']}笔，总值: {analysis['sent_transactions']['total_value']} ETH")
# print(f"接收交易: {analysis['received_transactions']['count']}笔，总值: {analysis['received_transactions']['total_value']} ETH")

# 区块链交易异常检测示例
import pandas as pd
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

def detect_anomalies(transaction_data, features=None):
    """使用机器学习检测交易异常"""
    if features is None:
        features = ['value', 'fee', 'input_count', 'output_count', 'transaction_size']
    
    # 准备特征数据
    X = transaction_data[features].copy()
    
    # 数据标准化
    scaler = StandardScaler()
    X_scaled = scaler.fit_transform(X)
    
    # 训练孤立森林模型
    model = IsolationForest(contamination=0.05, random_state=42)
    anomalies = model.fit_predict(X_scaled)
    
    # 添加异常检测结果
    transaction_data['is_anomaly'] = anomalies == -1
    transaction_data['anomaly_score'] = model.decision_function(X_scaled)
    
    # 获取异常交易
    anomaly_transactions = transaction_data[transaction_data['is_anomaly']]
    
    # 生成统计摘要
    summary = {
        'total_transactions': len(transaction_data),
        'anomaly_count': len(anomaly_transactions),
        'anomaly_percentage': len(anomaly_transactions) / len(transaction_data) * 100,
        'anomaly_summary': anomaly_transactions[['txid', 'value', 'anomaly_score']].sort_values('anomaly_score')
    }
    
    return {
        'summary': summary,
        'data_with_predictions': transaction_data
    }

# 使用示例
# 假设我们有交易数据DataFrame
tx_data = pd.DataFrame({
    'txid': ['tx1', 'tx2', 'tx3', 'tx4', 'tx5'],
    'value': [1.0, 2.5, 1000.0, 0.5, 1.2],
    'fee': [0.0001, 0.0002, 0.01, 0.00005, 0.00015],
    'input_count': [2, 1, 5, 1, 3],
    'output_count': [1, 2, 10, 1, 2],
    'transaction_size': [250, 180, 1200, 150, 220]
})

# results = detect_anomalies(tx_data)
# print(f"检测到 {results['summary']['anomaly_count']} 笔异常交易")
# print(f"异常交易占比: {results['summary']['anomaly_percentage']:.2f}%")
# print("\n异常交易详情:")
# print(results['summary']['anomaly_summary'])

# 交易网络可视化示例
import networkx as nx
import matplotlib.pyplot as plt
import pandas as pd
import numpy as np

def visualize_transaction_network(transactions, focus_address=None, depth=1, top_n=20):
    """可视化交易网络"""
    # 创建有向图
    G = nx.DiGraph()
    
    # 添加交易节点和边
    for _, tx in transactions.iterrows():
        # 添加地址节点
        G.add_node(tx['from_address'], type='address')
        G.add_node(tx['to_address'], type='address')
        
        # 添加交易边，边权重为交易金额
        G.add_edge(
            tx['from_address'], 
            tx['to_address'], 
            weight=tx['value'],
            txid=tx['txid'],
            timestamp=tx['timestamp']
        )
    
    # 如果指定了焦点地址，提取子图
    if focus_address and focus_address in G.nodes:
        # 获取指定深度的邻居
        neighbors = set()
        current_nodes = {focus_address}
        
        for _ in range(depth):
            next_nodes = set()
            for node in current_nodes:
                # 添加入边和出边的邻居
                next_nodes.update(G.neighbors(node))
                next_nodes.update(G.predecessors(node))
            
            neighbors.update(next_nodes)
            current_nodes = next_nodes
            if not current_nodes:  # 如果没有更多邻居，提前结束
                break
        
        # 确保焦点地址在子图中
        neighbors.add(focus_address)
        
        # 创建子图
        G = G.subgraph(neighbors)
    
    # 如果节点太多，只保留最活跃的节点
    if len(G.nodes) > top_n:
        # 计算节点度数（交易数量）
        degrees = dict(G.degree())
        
        # 按度数排序，选择前N个节点
        top_nodes = sorted(degrees.items(), key=lambda x: x[1], reverse=True)[:top_n]
        top_node_ids = [node[0] for node in top_nodes]
        
        # 创建子图
        G = G.subgraph(top_node_ids)
    
    # 节点大小基于度数
    node_size = [degrees[node] * 100 for node in G.nodes]
    
    # 边宽度基于交易金额
    edge_width = [G[u][v]['weight'] * 0.1 for u, v in G.edges]  # 缩放权重以便可视化
    
    # 布局算法
    pos = nx.spring_layout(G, k=0.3, iterations=50, seed=42)
    
    # 绘制图形
    plt.figure(figsize=(15, 15))
    
    # 绘制节点
    nx.draw_networkx_nodes(G, pos, node_size=node_size, node_color='lightblue')
    
    # 绘制边
    nx.draw_networkx_edges(G, pos, width=edge_width, edge_color='gray', arrowsize=20)
    
    # 标记节点（只标记部分以避免混乱）
    if len(G.nodes) <= 20:
        nx.draw_networkx_labels(G, pos, font_size=10, font_family='sans-serif')
    else:
        # 只标记度数最高的几个节点
        top_labels = {node: node[:8] + '...' for node, _ in top_nodes[:5]}
        nx.draw_networkx_labels(G, pos, labels=top_labels, font_size=10, font_family='sans-serif')
    
    plt.title('区块链交易网络可视化', fontsize=15)
    plt.axis('off')
    
    # 保存图形
    # plt.savefig('transaction_network.png', dpi=300, bbox_inches='tight')
    plt.show()
    
    return G

# 使用示例
# 创建示例交易数据
# tx_data = pd.DataFrame({
#     'txid': [f'tx{i}' for i in range(10)],
#     'from_address': [f'addr{i}' for i in range(10)],
#     'to_address': [f'addr{(i+3) % 10}' for i in range(10)],
#     'value': np.random.uniform(0.1, 10, 10),
#     'timestamp': pd.date_range(start='2023-01-01', periods=10, freq='D')
# })
# 
# # 可视化网络
# G = visualize_transaction_network(tx_data, focus_address='addr1', depth=2)

# 区块链取证自动化工具链示例
import os
import json
import time
import logging
from datetime import datetime

# 配置日志
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler("blockchain_forensics.log"),
        logging.StreamHandler()
    ]
)
logger = logging.getLogger("blockchain_forensics")

class BlockchainForensicsToolchain:
    """区块链取证自动化工具链"""
    
    def __init__(self, config_path="config.json"):
        """初始化工具链"""
        self.config = self.load_config(config_path)
        self.output_dir = self.config.get("output_dir", f"forensics_output_{int(time.time())}")
        os.makedirs(self.output_dir, exist_ok=True)
        logger.info(f"初始化区块链取证工具链，输出目录: {self.output_dir}")
    
    def load_config(self, config_path):
        """加载配置文件"""
        try:
            with open(config_path, 'r') as f:
                return json.load(f)
        except Exception as e:
            logger.error(f"加载配置文件失败: {e}")
            # 返回默认配置
            return {
                "blockchain": "bitcoin",
                "api_providers": {
                    "bitcoin": "https://blockchain.info",
                    "ethereum": "https://api.etherscan.io"
                },
                "output_dir": "forensics_output"
            }
    
    def collect_evidence(self, addresses, start_date=None, end_date=None):
        """收集证据"""
        logger.info(f"开始收集证据，地址数量: {len(addresses)}")
        
        evidence = {
            "collection_time": datetime.now().isoformat(),
            "addresses": addresses,
            "blockchain": self.config.get("blockchain", "bitcoin"),
            "transactions": {},
            "metadata": {}
        }
        
        # 这里添加实际的数据收集逻辑
        # 示例：
        # for address in addresses:
        #     evidence["transactions"][address] = self.fetch_transactions(address, start_date, end_date)
        
        # 保存原始证据
        evidence_path = os.path.join(self.output_dir, "raw_evidence.json")
        with open(evidence_path, 'w') as f:
            json.dump(evidence, f, indent=2)
        
        logger.info(f"证据收集完成，保存至: {evidence_path}")
        return evidence_path
    
    def analyze_transactions(self, evidence_path):
        """分析交易数据"""
        logger.info(f"开始分析交易数据: {evidence_path}")
        
        # 读取证据
        with open(evidence_path, 'r') as f:
            evidence = json.load(f)
        
        # 这里添加实际的分析逻辑
        # 示例：
        # analysis = {
        #     "transaction_summary": {},
        #     "address_clusters": [],
        #     "suspicious_patterns": []
        # }
        
        # 保存分析结果
        analysis_path = os.path.join(self.output_dir, "transaction_analysis.json")
        # with open(analysis_path, 'w') as f:
        #     json.dump(analysis, f, indent=2)
        
        logger.info(f"交易分析完成，保存至: {analysis_path}")
        return analysis_path
    
    def generate_report(self, analysis_path):
        """生成取证报告"""
        logger.info(f"开始生成取证报告: {analysis_path}")
        
        # 读取分析结果
        with open(analysis_path, 'r') as f:
            analysis = json.load(f)
        
        # 生成HTML报告
        report_path = os.path.join(self.output_dir, "forensics_report.html")
        
        # 这里添加实际的报告生成逻辑
        # 示例：
        # with open(report_path, 'w') as f:
        #     f.write(f"""
        #     <html>
        #     <head><title>区块链取证报告</title></head>
        #     <body>
        #         <h1>区块链取证报告</h1>
        #         <p>生成时间: {datetime.now().isoformat()}</p>
        #         <!-- 添加报告内容 -->
        #     </body>
        #     </html>
        #     """)
        
        logger.info(f"取证报告生成完成，保存至: {report_path}")
        return report_path
    
    def run_pipeline(self, addresses, start_date=None, end_date=None):
        """运行完整的取证流程"""
        logger.info(f"启动区块链取证流水线")
        
        try:
            # 1. 收集证据
            evidence_path = self.collect_evidence(addresses, start_date, end_date)
            
            # 2. 分析交易
            analysis_path = self.analyze_transactions(evidence_path)
            
            # 3. 生成报告
            report_path = self.generate_report(analysis_path)
            
            logger.info(f"取证流水线执行完成")
            return {
                "status": "success",
                "evidence_path": evidence_path,
                "analysis_path": analysis_path,
                "report_path": report_path
            }
        
        except Exception as e:
            logger.error(f"取证流水线执行失败: {e}")
            return {
                "status": "error",
                "error": str(e)
            }

# 使用示例
# if __name__ == "__main__":
#     # 示例配置文件
#     config = {
#         "blockchain": "bitcoin",
#         "output_dir": "forensics_output"
#     }
#     
#     with open("config.json", 'w') as f:
#         json.dump(config, f)
#     
#     # 初始化工具链
#     toolchain = BlockchainForensicsToolchain()
#     
#     # 运行取证流程
#     result = toolchain.run_pipeline(
#         addresses=["1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"],  # 比特币创世地址作为示例
#         start_date="2023-01-01",
#         end_date="2023-01-31"
#     )
#     
#     print(f"取证流程结果: {result['status']}")
#     if result['status'] == "success":
#         print(f"报告路径: {result['report_path']}")

# 区块链取证调查报告

## 1. 执行摘要
- 调查目的与范围
- 主要发现
- 结论与建议

## 2. 调查背景
- 案件概述
- 涉案区块链信息
- 相关法律法规

## 3. 取证方法
- 使用的工具与技术
- 数据来源
- 分析方法
- 验证过程

## 4. 证据收集
- 原始数据描述
- 数据提取方法
- 数据完整性保障

## 5. 分析结果
- 交易分析
- 地址关联
- 时间线重建
- 异常模式识别

## 6. 结论
- 发现总结
- 可信度评估
- 局限性说明

## 7. 建议
- 法律行动建议
- 进一步调查方向
- 安全改进措施

## 8. 附录
- 技术细节
- 原始数据样本
- 工具版本信息
- 参考资料