基于Linux的IM服务计算机取证系统研究

Computer Forensics System for Instant Message Service Based on Linux

对Linux下实时通信软件的分类、配置、构成进行了分析,提出了一种基于多Agent的计算机取证模型,给出了系统的结构和设计,以及采用的关键技术.该系统能够准确地定位和收集LumaQQ等Linux实时通信信息,进行数据分析,形成取证报告.

This paper analyses the classes, configuration and structure of instant message soft on Linux, puts forward a model of computer forensics based on Multi-Agent. It presents the structure of the system, the design and implement of the key modules and technologies. This system which uses distributed technology accurately locates, collects and analyses the data of IM communication and makes forensics reports finally.