数据恢复技术在涉案计算机侦查取证中的应用研究

随着科技的进步,犯罪分子的犯罪手段也越来越高技术化,犯罪分子反侦察意识的增强,会有意识地将存储设备中的犯罪证据销毁,给公安机关侦查取证带来不小的困难。数据恢复是一种从被损坏或删除的文件中恢复有价值数据,当重要电子证据丢失或损毁时,如何快速恢复电子数据是侦查人员必须掌握的技术。在结合已有的数据恢复软件和取证工具的基础上,重点介绍了利用Win Hex软件,根据文件签名特征和关键字搜索方法快速恢复数据,并在实际案例中发挥很大的作用。

With the progress of science and technology,the means of crime crime means more and more intelligent,with the awareness of anti investigation,criminals will have the awareness of evidence of a crime will be a storage device for destruction,poses difficulties for investigation of public security organs.Data recovery is a way to recover valuable data from damaged or deleted files.How fast electronic data can be recovered when an important electronic evidence is lost or destroyed is a skill that investigators must master.On the basis of the existing data recovery software and forensics tools,focuses on the use of WinHex software,the rapid recovery of data according to the file signature features and keyword search method,and play a significant role in the actual case.