破坏工业控制系统案件的电子数据取证研究

Digital Forensic Evidence Collection from the Cyber-destruction against Industrial Control System

本文介绍了一类工程机械设备GPS远程监控系统被破坏案件的取证检验方法,首先研究了工程机械设备GPS远程监控系统的结构和工作原理,然后对工程机械设备被非法"解锁"的犯罪手段进行分析,并对犯罪活动实施过程中涉及的设备及电子数据进行分析、提取和检验,最后对案件的取证要点进行了总结和讨论。

A digital forensic evidence collection was here introduced on a case of cyber-destruction against the industrial control system-based GPS remote monitoring network. Through the analysis of the structure and working principle about how the GPS remote monitoring system controls the engineering mechanical equipment, a discovery was attained on two illegal artifces by which the engineering mechanical equipment was unlocked from the GPS control. Moreover, the facilities involved in committing the crime were investigated so that the digital forensics were conducted on electronic data parsing, extraction and examination. Finally, a conclusion was achieved on the main points of digital forensics in the case.