基于计算机取证的Linux文件系统解析与设计  

Linux file system analysis and design based on computer forensics

作　　者：刘春枚[1] 

机构地区：[1]昆明船舶设备研究试验中心,云南昆明650051

出　　处：《中国测试》2013年第S2期108-111,共4页China Measurement & Test

摘　　要：Ext2是Linux操作系统的基本文件系统,保存和管理重要的文件信息,挖掘分析其中的有用数据已成为目前计算机调查取证的重要手段和研究方向。该文对Ext2文件系统的存储原理进行分析,通过面向对象的思想进行Linux文件系统解析平台开发,对保存在磁盘上的二进制数据文件进行解析,并将提取到的所有文件信息转换成友好的用户界面形式,同时提供各种有用的接口供计算机取证分析,为计算机取证技术在Linux上的应用提供强有力的工具。Ext2 is a basic file system of Linux system for saving and managing a lot of important file information. Finding and analyzing useful data of the Linux operating system has become important means and research directions of computer forensics. In this paper,after analyzing and researching the storage principle of Ext2 file system in detail, the object-oriented method is proposed to design the parsing platform of Linux file system. By parsing the binary data files storing on the disk,all the file information extracted is converted into the form of user-friendly interface. Meanwhile, it provides plenty of useful interfaces for the computer forensic analysis, which will be an important information-gaining tool for the computer forensics on the Linux operating system.

关 键 词：EXT2 文件系统解析 面向对象 计算机取证 

分 类 号：TP311.1[自动化与计算机技术—计算机软件与理论] TP316.85[自动化与计算机技术—计算机科学与技术]