新型电子数据反取证技术研究

Novel Digital Data Anti- Forensic Technology

当前,国内外涌现了大量新型的反取证技术和工具。反取证技术的发展给电子数据取证工作带来较大挑战,影响了取证的可靠性和安全性。首先,对反取证技术从基于对象、基于证据影响和基于操作系统三个方面进行了分类;其次,研究分析了数据清除、数据隐藏、数据伪造、取证工具攻击等四类新型的反取证技术以及具体的方法和常用工具;最后,在计算机信息系统本身、取证工具、取证标准规范三个方面提出了反取证技术的应对措施。

Nowadays many new digital data anti-forensic techniques and tools spring up both at home and abroad. Anti-forensic technology bings great challenges to the digital forensic work, and this may directly affect the reliability and security of evidence. First- ly, anti-forensics classification is clone on the bases of target, evidence impact and operating system ; then the four new anti-forensic techniques and tools involing data eliminating, data hiding, data fabrication and attacks against forensic tools are analyzed; and finally the countermeasures against anti-forensic technology in the three fields of eomputer information system itself, forensic tools and stand- ards are proposed.