Windows系统回收站的电子物证特性分析比较研究  

Comparative Study on the Characteristics of Electronic Evidence in Windows System Recycle Bin

作　　者：王志铭 WANG Zhiming(Criminal Investigation Police University of China,Cyber Crime Investigation Department,Shenyang 110854,China)

机构地区：[1]中国刑事警察学院网络犯罪侦查系

出　　处：《现代信息科技》2019年第11期87-88,91,共3页Modern Information Technology

基　　金：辽宁省社科基金项目(项目编号:L18BFX009);中国刑事警察学院研究生创新能力提升项目(项目编号:2017YCYB24、2018YCYB23)

摘　　要：本文着重对各个Windows版本的回收站进行分析研究。分析了Windows回收站的原理和功能、WindowsXP回收站文件格式、Windows7及Windows10的回收站文件格式。实现了针对Windows系统的回收站文件夹深层次的电子数据取证研究,同时在研究过程中主要利用Winhex软件对回收站所存储的文件进行分析,成功获取用户删除文件的文件内容、删除时间及删除路径等信息,旨在为电子数据取证完整证据链的构建提供可靠依据。This article focuses on the analysis of the various Windows versions of the recycle bin. Analyzed the principle and function of Windows recycle bin,Windows XP recycle bin file format,recycle bin file format for Windows 7 and Windows 10. The deep-level electronic data forensics research of the recycle bin folder for Windows system is realized. At the same time,Winhex software is mainly used to analyze the files stored in the recycle bin,and the file contents,deletion time and deletion of the deleted files are successfully obtained. Path information is intended to provide a reliable basis for the construction of a complete evidence chain for electronic data forensics.

关 键 词：WINDOWS 回收站 电子数据取证 

分 类 号：TP316.7[自动化与计算机技术—计算机软件与理论] D918.2[自动化与计算机技术—计算机科学与技术]