摘要
在计算机取证工作中,除了显见的数据内容的收集之外,还有一些地方可能存在着被隐藏起来的数据,获取这些隐藏的数据并将其拼接起来会揭示惊人的案件事实,为司法诉讼提供重要的证据。该文总结了当前比较流行的文件隐藏与获取的方法,首先分析了利用磁盘底层、流文件、操作系统、专用工具实现数据隐藏的方法,然后有针对性地提出了隐藏数据的获取方法,最后总结了当前被法证认可的综合取证工具在获取隐藏数据中的应用。
In computer forensics, in addition to data collection of visible content, there may exist some hidden data. The acquisition of these hidden data will reveal facts of the case and provide important evidence to judicial proceedings. In this paper, popular hiding and accessing methods of data were summarized. Firstly, the hiding methods through the bottom disk, flow file, operating system and specialized software tools were analyzed. Secondly, the access methods of hidden data were introduced. Finally, the software’s applications of the current authorized forensic integrated tools to access hidden data are summarized.
出处
《计算机安全》
2008年第1期45-47,共3页
Network & Computer Security
关键词
数据
隐藏
获取
方法
Data
Hide
Acquire
Method
