一起网络诈骗案中的电子物证检验.pdfVIP

刑事技术 2016 年 第41 卷 第6 期 ·技术与应用· DOI ：10.16467/j.1008-3650.2016.06.014 一起网络诈骗案中的电子物证检验 周 翔 ( 新疆生产建设兵团公安局，乌鲁木齐 830000) 摘　要：近年来，国内电信、网络诈骗案件频发，诈骗手法多变；其中犯罪分子冒充国家公、检、法机关工作 人员利用电话骗取受害人的信任，指使受害人登录指定网站、安装远程控制程序或木马，远程操作受害人的计 算机，登录受害人的网银账户，盗取受害人资金的案件发案率较高。对此类案件的电子物证取证分析存在一定 的难度，鉴定过程中易将此类案件归为计算机植入木马类案件进行分析，分析过程中会涉及到程序的反编译、 程序代码的跟踪执行等多个检验环节，使案件分析变得复杂。本文报道一案例，在分析过程中首先采用动态仿 真模拟出受害人的计算机，然后利用时间线技术分析案发时的计算机操作行为，通过电子物证取证分析，还原 了案发时计算机的操作行为，为案件的侦查提供了有力支撑。最后本文就此类案件的电子物证取证分析方法进 行探讨。 关键词： 电子物证；网络诈骗；动态仿真；时间线；远程控制软件 中图分类号 ：DF793.2 文献标识码 ：A 文章编号 ：1008-3650(2016)06-0491-03 Forensic Analysis on Collecting the Electronic Evidence from an Internet Fraud Case ZHOU Xiang (Public Security Bureau of Xinjiang Production and Construction Corps, Urumqi 830000, China) ABSTRACT: The telecommunication-and-internet fraud cases have occurred frequently in recent years. Offenders played volatile and tricky swindles to reach their goals. Some of the criminals pretended to be the official persons of public security, procuratorate and court to get trusted from the victims who were then instigated to log onto a specific website where a long- range control program or Trojan was to be introduced into the victims’ computers. Thus, the victims’ computers were able to be remotely operated and the accounts of these victims’ E-bank be broken into, resulting in their money in the bank to be stolen. It is really of certain difficulty to conduct the forensic electronic analysis about such cases because they are prone to be categorized into those implanted Trojan ones during the process of authentication which will be involved into a program decompiling, code tracking among the multiple tested l