计算机使用痕迹分析与取证系统

Using Trace for Analysis and Obtain Evidnce System of Computer

由于计算机证据具有易修改性、实时性、设备依赖性,又具有可以精确重复性等高科技特性,在技术上本系统采用的取证原则和步骤都是基于一种静态的视点,即事件发生后,对目标系统的静态分析,提取有用信息,其中包括上网浏览记录、Windows使用记录、办公软件使用记录、USB设备使用记录、常用软件记录等。本系统能够保证计算机取证的客观性、合法性、关联性和有效性。

As computer evidence had easy to modify, timeliness, device dependent, and accurate repeat high-tech characteristics, So the system adopted the principles and steps of evidence based on static viewpoint. The static viewpoint was that static analyzed of the target system, then extracted of useful information after the incident. The information included Internet browsing records, Windows recorcd, Use office software records , USB records, commonly used software record etc.. The system could guarantee the Computer Forensics objective, legal and effective.