网络入侵分析与数字证据的研究

Analysis of Network Intrusion and Research on Digital Evidence

本文首先给出了计算机取证的概念,然后描述了数字调查人员能够处理和利用的日志文件、状态表和其他同网络层和传输层有关的数据,最后将整个Internet作为证据源来讨论,解决了一些关键难题。

The concept of computer evidence is given first, and then log files, status tables, and other data related to network layer and transport layer which surveyors may hadle and make use are depicted. Finally the whole Interact is discussed as aboriginal evidence source, and some key problems are resolved.