基于Windows系统的计算机开机取证研究

Research of Computer Live Forensics based on Windows

随着计算机通信技术的飞速发展,互联网已全面进入千家万户,信息系统已成为国家的基础设施,支撑着科研、能源,通信、交通等各个方面,成为人类社会所必需的重要资源。与此同时,利用计算机与网络实施的犯罪活动也日益增多,信息系统的安全问题也更为严峻。文章以基于Windows系统的计算机开机取证为研究对象,结合实际工作对Windows系统开机取证的操作流程、技术方法进行了详细讨论,并总结出一套实用性较强的操作规范,为合法、高效地进行Windows系统开机取证提供了参考。

With the rapid development of the technology of computer communication, the Internet has full access to our life.Information systems have become the infrastructure of country, supporting various aspects of nation- building, such as scientific research, energy, communications, transportation and so on. Information systems have become important resources for human society. On the other hand, more and more computer-related crimes make computer security issues increasingly serious. In this paper, with computer live forensics based on Windows for study, operating procedures and methods of computer live forensics based on Windows are discussed in detail. A set of practical operating specifications are summarized,providing reference for carrying out computer live forensics based on Windows lawfully and efficiently.