Windows 7下USB存储设备接入痕迹的证据提取  

Evidence Extraction of USB Storage Device Accessing Traces under the Windows 7 System

作　　者：向大为[1] 吴燕波[2] 麦永浩[1] 

机构地区：[1]湖北警官学院,武汉430034 [2]湖北警官学院电子取证重点实验室,武汉430034

出　　处：《信息安全研究》2016年第4期333-338,共6页Journal of Information Security Research

基　　金：湖北省教育厅科学技术研究项目(B2015070);湖北警官学院科研重点项目(2015ZD010;2014GZ022;2012AT006)

摘　　要：随着计算机技术的快速发展和普及,各种计算机犯罪接踵而来,很多证据就存在于USB存储设备中.当USB存储设备接入计算机时,注册表键值和系统日志都会进行记录,因此计算机取证人员可以确定哪些USB设备、什么时间是否连接过计算机.通过较详细地介绍接入痕迹的位置和提取方法,为司法活动中的某些证据要素提供支持和帮助.With the rapid development and popularization of computer technology, cyber crimes come one after another , there are alot of computer evidences existing in the USB storage device. When USB storage device has access to computers, registry keys and computer log will record the accessing traces. Therefore, computer forensic investigators can accordingly confirm which USB device has connected to the computer at what time. This paper introduces the position of accessing traces and extraction methods, providing great support and help for certain evidence factors in judicial activities.

关 键 词：USB存储设备 WINDOWS 7 注册表 系统日志 接入痕迹 

分 类 号：TP316.7[自动化与计算机技术—计算机软件与理论]