Python编程在电子数据取证分析中的应用

The application of python programming in digtal forensics and analysis

近年来,电子数据取证分析技术日益成熟,大部分电子数据取证分析工具都能对主流的应用程序数据进行提取解析,提高了电子数据取证分析人员工作效率的同时也降低了电子数据取证分析人员的技术门槛。然而,在实际电子数据取证分析工作中,目前基于预设策略的电子数据取证分析工具无法智能化、自动化地对新的应用程序数据进行提取解析。如何提取解析数据量大、数据复杂的应用程序数据,这给电子数据取证分析人员提出新的挑战,成为目前取证分析工作中的难点。

In recent years,the technology of digtal forensics and analysis is increasingly mature.The mainstream application data can be extracted and analyzed by most of the digtal forensics and analysis tools,so that it can improve digital forensic investigation works efficiency while also reducing the technical threshold.However,in practical work,tools which is based on default policies can not extracted and analyzed the new application data intelligently and automatically.For digital forensic investigators,it's a big challenge to extracted and analyzed the large and complex application data.