云计算取证模型

Cloud computing forensic model

针对云取证面临的主要挑战,分析云计算特性,提出了一种云取证模型。提出了持续性取证准备服务的部署、基于"迭代"的多轮次证据识别策略和分布式文件系统的多层级数据定位方法、基于"数据隔离"和"按需收集"策略的证据收集方法、基于云计算资源的综合性证据分析平台的建立。最后,结合云环境下的取证场景,分析了该模型的有效性。

Aiming at the main challenges facing cloud forensics, cloud characteristics were analyzed and a cloud forensic model was proposed. In the model, the deployment of persistent forensic readiness service, multi-round identification strategy based on ＂iteration＂ and multi-level evidence location method for distributed file system, ＂data isolation＂ and ＂on-demand collection＂ strategies, and the establishment of comprehensive evidence analysis platform based on cloud resources were presented. Finally, the validity of the model was analyzed combining the forensic scene in the cloud environment.