一种抽象的数字取证模型  

An Abstract Digital Forensic Model

作　　者：郑捷文[1] 许榕生[1] 张晋[2] 

机构地区：[1]中国科学院高能物理研究所计算中心中国科学院研究生院,北京100039 [2]海南大学信息学院,海口570228

出　　处：《计算机工程》2006年第1期163-165,共3页Computer Engineering

摘　　要：介绍了数字取证和数字取证模型的概念,然后通过对基于刑事侦查和基于企业内部网的数字取证异同点的比较,结合数字取证在非数字化犯罪领域应用中的特点,在前人工作的基础上,提出了一种不局限于特定数字取证类型、以取证实施者为中心、使用状态转换图描述的抽象数字取证模型,采用取证循环的形式描述了数字取证的过程和特征。This article introduces the concept of digital forensics and digital forensic model, compares the difference between the usage of digital forensic in criminal investigating and in enterprise environment. Then, considering the usage of digital forensic in non-digital criminal fields, it provides an abstract digital forensic model that is based on the former work of other experts. The new abstract model, which describes the process of digital forensic as a forensic cycle, focuses on the actor of forensic instead of the evidence itself. It is general enough to describe the character of digital forensic in both digital criminal and non-digital criminal fields, and abstract enough to fit not only law enforcement users, but also fol enterprise users.

关 键 词：数字取证 取证实施者 取证循环 证据收集 取证分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]