基于Windows系统的计算机开机取证研究  

Research of Computer Live Forensics based on Windows

作　　者：胡雪峰[1] 杨柳[1] 周磊[1] 朱逢春[1] 

机构地区：[1]上海市公安局杨浦分局网络安全保卫支队,上海200090

出　　处：《信息网络安全》2013年第7期70-73,共4页Netinfo Security

摘　　要：随着计算机通信技术的飞速发展,互联网已全面进入千家万户,信息系统已成为国家的基础设施,支撑着科研、能源,通信、交通等各个方面,成为人类社会所必需的重要资源。与此同时,利用计算机与网络实施的犯罪活动也日益增多,信息系统的安全问题也更为严峻。文章以基于Windows系统的计算机开机取证为研究对象,结合实际工作对Windows系统开机取证的操作流程、技术方法进行了详细讨论,并总结出一套实用性较强的操作规范,为合法、高效地进行Windows系统开机取证提供了参考。With the rapid development of the technology of computer communication, the Internet has full access to our life.Information systems have become the infrastructure of country, supporting various aspects of nation- building, such as scientific research, energy, communications, transportation and so on. Information systems have become important resources for human society. On the other hand, more and more computer-related crimes make computer security issues increasingly serious. In this paper, with computer live forensics based on Windows for study, operating procedures and methods of computer live forensics based on Windows are discussed in detail. A set of practical operating specifications are summarized,providing reference for carrying out computer live forensics based on Windows lawfully and efficiently.

关 键 词：WINDOWS系统 开机取证 计算机犯罪 电子证据 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]