一个基于跟踪的计算机取证过程模型  

A Computer Forensics Process Model based on Tracking

作　　者：李焕洲[1] 张健[1] 陈麟[1] 

机构地区：[1]四川师范大学电子工程学院,四川成都610068

出　　处：《微计算机信息》2007年第36期232-233,147,共3页Control & Automation

基　　金：国家自然科学基金资助项目(10076011);四川省软科学研究项目(2006R16-021)

摘　　要：为了克服基于"事后取证"理念而设计的计算机取证过程模型的不足,借鉴传统刑事案件侦查的"秘密侦查措施",在计算机取证技术体系中引入"跟踪"、"监控"、"网络渗透"等主动采集技术,提出了一个基于跟踪的计算机取证过程模型。介绍了该模型的工作流程,分析了该模型的特色,指出了该模型的适用范围。In order to overcome the flaw of Computer Forensics Process Model based on the concept of after-action forensics, a better Computer Forensics Process Model was built. In this model, ＂Tracking, ＂Monitoring＂, ＂Network-penetrating＂ and other positive- seeking techniques referring the skills of traditional crime spying was adopted to the Computer Forensics. The work process of the model was introduced, the feature of the model was analyzed, and the application scope of the model was also shown.

关 键 词：计算机取证 过程模型 被动收集 主动采集 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]