UNIX系统取证的内容搜索方法研究

Research of Content Search in Computer Forensic of UNIX System

大量重要的应用服务器或网络服务器使用可靠性强的UNIX操作系统。研究UNIX系统下常用的内容搜索技术及其原理,可以减少取证分析过程中需要检查的数据量,快速挖掘有效证据。UNIX环境下的搜索工具在静态取证分析中的应用研究,可以帮助调查人员在证据收集和分析过程中缩小检查的数据范围,提高取证分析效率。

Reliable UNIX system is widely used in important application server or network server.Researching the techniques and principles of content search in UNIX system can reduce the amount of inspection data and dig valid evidence fast in the process of analysis.Studying search tools of UNIX system used in static forensic can help investigators to narrow the scope of inspection data,and improve the efficiency of computer forensic analysis in the process of evidence collection and analysis.