计算机取证模型研究

Study on Computer Forensics Model

计算机取证的模型多种多样,但都没有从根本上解决计算机证据的可采用性问题。在对现有模型的深入研究和分析的基础上提出了一个多维计算机取证模型,该模型既兼容了现有的模型,又增加了时间约束和对取证过程的全程监督,使得取证策略可以随时间变化并可以把取证过程的监督数据作为证据的一部分呈堂。

There are various computer forensics models now. But these models can not solve the problem of the computer evidence＇s adoption. In this paper, based on the study and analysis of all the existing models, A new computer forensics model is presented. It not only is compatible with all the other models but also adds time and monitor for the whole computer forensics process. This makes it possible that the computer forensics policies can change with time and the monitor data can be a part of the presentation in court.