计算机取证综述

A Review of Computer Forensics

计算机取证就是利用计算机技术,按照合法的程序与规范对计算机犯罪证据进行发现、固定、提取、分析和表达的过程。在计算机证据搜集的过程中应遵循合法性原则、及时性原则、安全性原则、以易失程度为序原则。虽然计算机取证技术和工具等已取得一定的成果,但为了能让计算机取证工作向着更好的方向发展,制定取证工具的评价标准、取证机构和从业人员的资质审核办法以及取证工作的操作规范是非常必要的。

Computer forensics is to make use of computer science to discover, fix, withdraw, and analyz computer crime evidence. Collecting computer crime evidence should follow a legitimacy principle, time principle, safety principle and take losing degree easily as a preface principle. Although Computer technique and tool have made some achievement, the evaluation standard of computer forensics tools, the certification of computer forensics organization and staff, the operation norm for computer forensics is necessary.