基于HTTP协议报文分析的计算机网络取证方法

Computer Network Forensics Method Based on HTrP Protocol Packet Analysis

计算机系统之间的网络通信遵循HTTP网络协议，网络中HTTP协议报文承栽着犯罪分子利用计算机系统及计算机网络进行犯罪的大量“作案痕迹”，因此报文分析可以为打击计算机网络犯罪提供非常重要的线索和证据来源。利用Burp Suite报文分析将网络犯罪分子作案过程中的各种行为和操作过程作为有效的电子证据真实完整地出示给法庭，结合取证实例详细探讨报文分析在电子数据取证中的运用。

Network communications between computer systems follow the HTTP network protocol. HTTP protocol packets carry the criminals crime by computer systems and computer networks with a large number of traces of the crime, so packets analysis is very important to fight against cyber crime by providing clues and evidence sources. Using Burp Suite packets analysis to present the Cyber criminal＇s criminal act as an effective electronic evidence to the Court, combining with practical evidence packet analysis, the application of packet analysis in electronic data forensics was discussed in detail.