基于Windows平台的动态取证系统  

Dynamic Forensics System Based on Windows Platform

作　　者：文少勇[1] 王箭[1] 李剑 

机构地区：[1]南京航空航天大学计算机科学与技术学院,南京210016 [2]南昌陆军学院战斗实验室,南昌330103

出　　处：《计算机系统应用》2012年第2期13-17,共5页Computer Systems & Applications

摘　　要：针对目前一些动态取证模型的不足,在分布式网络取证模型的基础上设计了一个基于Windows平台的动态取证系统,能够实现网络中的计算机作为作案目标和作案工具双重角色时的取证,具有实时获取多种数据源、取证过程隐秘、取证分析算法可扩展等特点。介绍了动态取证系统中各功能模块设计,并阐述了系统设计中涉及到的关键技术,最后通过模拟测试表明该系统能够在Windows网络下实现动态取证。In view of the shortages of some dynamic forensics model at present,this paper designs a dynamic forensics system in distributed network forensics model based on Windows platform,which can realize obtaining evidence on the computers that plays a dual role on the network as crime goals and crime tools,and have the characteristic of real-time accessing various data sources,forensics process secretive,forensic analysis algorithm extensible etc.This paper introduces the designing of each function module in the dynamic forensics system at first.Second,it lays out the key technology that appears in the design process of the system.Finally,simulation test indicates that the system can realize dynamic forensics in Windows network.

关 键 词：计算机取证 动态取证 获取技术 隐秘技术 

分 类 号：D918.2[政治法律—法学] TP316.7[自动化与计算机技术—计算机软件与理论]