摘要
在Windows NT／2000初始响应期间,收集现场易失的数据的措施有:俘获和追踪; 端口监控;确定当前和最近的连接;捕获事件日志;监听应用程序;查看注册表等。
Collecting the easy lose data, we are able to the following ways: catching and tracking, keeping watch on the computer interface, setting out the current and lately link, catching the daily record of computer, determining system's landing personnel, keeping watch on the applied program, looking over the registered chart and so on.
