基于远程控制技术的动态取证系统  

System of Dynamic Computer Forensic Based on Remote Control Technology

作　　者：史伟奇[1] 张波云[2] 谢冬青[1] 

机构地区：[1]湖南大学软件学院 [2]国防科技大学计算机学院,长沙410073

出　　处：《计算机工程》2007年第16期117-119,122,共4页Computer Engineering

基　　金：国家自然科学基金资助项目(60373085);公安部应用创新基金资助项目(2005YYCXHNST095)

摘　　要：设计了一种新的基于远程控制技术的计算机取证系统,提供了3种不同取证方法动态获取控制目标的电子证据,研究了文件隐藏、进程隐藏、注册表修改隐藏、端口反弹、数据加密等关键技术。实验表明,该系统能动态获取网上不同监控对象的电子证据,是当前取证技术的一种新思路。A novel computer forensics system based on remote control technology is present. By using three different ways of evidence-obtaining and evidence-controlling for different subjects, the system can realize objective of dynamic obtaining electronic evidence of the monitored subjects, including the research on the key technologies of process hiding and file hiding, register modifying and hiding, ports back-bouncing, and data encrypting about the system as well. Experimental result shows that the system realizes the active obtaining evidence to the monitored subjects on the network by different applications, and it demonstrates that this is a new technical thinking in the current computer forensics technology.

关 键 词：计算机取证 远程控制 电子证据 动态获取 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]