计算机取证中时间戳问题的研究1-江苏省计算机网络技术重点实验室.PDF

1 2 Study on Time-Stamp Issues about Computer Forensics Abstract: In the investigation of a criminal case involving a computer or computer network, the timeline of events may help to reconstruct the scenario of criminal, can determine whether the suspects have chance to commit a crime, even can help to ultimately determine the guilt or innocence of those who facing criminal charges. The computer system provides time-stamp functions, which can help us construct correct timeline of the event during computer forensics. This paper introduces the conception of computer forensics and characteristics of electronic evidence. We give a summary of the function of time-stamp and relative issues in computer forensics. Finally, we provide the methods of computer forensics with time-stamp. Key word: computer forensics, electronic evidence, time-stamp 1 International Association of Computer Specialist (IACS)1991 1 BM2003201 21