基于网络动态取证系统的设计与实现  

Design and Implementation of Dynamic Computer Forensics System Based on Network

作　　者：于志宏[1] 刘喆[2] 赵阔[1] 努尔布力[1] 史光坤[1] 胡亮[1] 

机构地区：[1]吉林大学计算机科学与技术学院,吉林长春130012 [2]吉林省经济管理干部学院,吉林长春130012

出　　处：《吉林大学学报（理学版）》2008年第4期716-720,共5页Journal of Jilin University:Science Edition

基　　金：国家自然科学基金(批准号:60473099);教育部新世纪优秀人才支持计划项目基金(批准号:NCET-06-0300)

摘　　要：提出并实现一个基于网络的动态计算机取证系统.该系统不同于传统的取证工具,它将取证工作提前至犯罪行为发生前与进行中,避免了由于取证不及时而导致的证据链缺失,有效地提高了取证工作的效率,增强了数据证据的完整性和时效性.In order to solve the problems existed in static forensics technology, this paper presents the design and implementation of a dynamic computer forensics system based on network. Compared with the traditional tools of the system, it performs the work of gathering evidence in advance before criminal action has occurred or in the process of crime so as to avoid the evidence chain lost caused by evidence not Scout timely. It can improve the efficiency of the work of gathering evidence; enhance data integrity and timeliness of evidence. This paper describes the architecture, function and work flow, core module technology. the implementation of main functions of the core module technology.

关 键 词：计算机取证 电子证据 日志 协议分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]