一种基于日志的U盘取证模型研究  

Research on a Log Based U-Disk Forensics System Model

作　　者：张若箐[1,2] 牛飞斐[3] 

机构地区：[1]西安电子科技大学通信工程学院,西安710071 [2]北京电子科技学院,北京100070 [3]河南理工大学计算机科学与技术学院,河南焦作454003

出　　处：《北京电子科技学院学报》2013年第2期71-75,90,共6页Journal of Beijing Electronic Science And Technology Institute

基　　金：国家自然科学基金项目(NO.61070219);中央高校基本科研业务费专项资金资助课题;北京电子科技学院信息安全重点实验室资助课题

摘　　要：为解决windows环境下U盘在计算机中的读写操作难以记录和保存的问题,对U盘与计算机的整个交互流程和U盘的惟一性标识开展研究,在该基础上设计了基于日志的U盘取证系统模型。该模型采用特殊的日志文件结构,通过基于WDM框架的过滤驱动程序来获取U盘在系统中留下的痕迹,并采用特殊的方式进行存储。分析结果表明,该模型切实可行,能够记录U盘从系统中获得的数据及行为,构建有效的证据链供司法取证调查使用。In order to solve the problem of recording and saving the read - write operation of U disk in windows, the whole interaction process between U disk and computer and unique identifier of U disk are studied. Firstly, a digital forensics system model of U disk based on log is designed. A special structure of log file and a filter driver based on WDM framework are adopted in order to obtain the trace of U disk leaving in system. Hash function is also considered to ensure the integrity of log events. The analysis results show the model is feasible. Using this technology can record data which U disk copy from system and its behavior and build an effective chain of evidence for investigation

关 键 词：计算机取证 日志 过滤驱动 U盘 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]