- 1、本文档共4页,可阅读全部内容。
- 2、原创力文档(book118)网站文档一经付费(服务费),不意味着购买了该文档的版权,仅供个人/单位学习、研究之用,不得用于商业用途,未经授权,严禁复制、发行、汇编、翻译或者网络传播等,侵权必究。
- 3、本站所有内容均由合作方或网友上传,本站不对文档的完整性、权威性及其观点立场正确性做任何保证或承诺!文档内容仅供研究参考,付费前请自行鉴别。如您付费,意味着您自己接受本站规则且自行承担风险,本站不退款、不进行额外附加服务;查看《如何避免下载的几个坑》。如果您已付费下载过本站文档,您可以点击 这里二次下载。
- 4、如文档侵犯商业秘密、侵犯著作权、侵犯人身权等,请点击“版权申诉”(推荐),也可以打举报电话:400-050-0827(电话支持时间:9:00-18:30)。
查看更多
Windows操作系统环境下调查USB设备使用痕迹方法研究
刑事技术2015 年 第40 卷 第2 期DOI:10.16467/j.1008-3650.2015.02.013·论著·Windows操作系统环境下调查USB设备使用痕迹方法研究段严兵,罗文华(中国刑事警察学院网络犯罪侦查系,沈阳110854)USB Device Usage Traces in WindowsEnvironmentDUANYan-bing,LUOWen-hua(DepartmentofNetworkCriminalInvestigation,NationalPoliceUniversityofChina,Shenyang110854,China)ABSTRACT:Inthepracticeofdigitalforensics,thekeyevidencetoprovethecriminalfactsmostlyexistsinthemountedUSBdevices.ToobtaintheusagetracesofinspectingUSBdeviceseverbeingmountedisatypicalidentificationrequirementof digitalforensics.Therearesomeexistingforensictoolsthatsupporttheanalysisofsuchinformation.However,extractingtracesinactualworkisnotaccurate(especiallyUSBdeviceserialnumber)andnotcomplete(suchaslackingtheinformationofUSBdriveletter).Itisdifficulttomeettheneedofforensicpractice.Inordertomakeupfordeficiencies,thispaperinvestigatesUSBdevicesusagetracesfromtwoaspectsbasedontheperspectiveoftheelectronicdataforensics.OneisusingtheregistrytoinspectUSB devices usage traces. The registry is the main and important source of USB devices usage traces. This paper describestheforensicsofUSBkeyandUSBSTORkeyindetail,andgivestheextractingmethodoftemporalinformationandcorrelationmethodwithMountedDeviceskey.ItalsoprovidestheanalysisofUMBkeythatisthenewincreaseofWindows7system. UMBkeycoverstheimportantinformationforUSBkeyandUSBSTORkey,whichindicatestheinformationofUSBdriveletterandmakesupforthedefectofMountedDeviceskey.TheotheraspectisusingthesystemfilestoinspectUSBdevicesusagetraces. This also has direct significance for meeting forensic requirements. Setupapi.dev.log file in Windows 7 systempartitioncontainsthedataabouttheequipmentreplacement,thedriverchangeandtheimportantsystemmodification.Theinvestigationand analysis of Setupapi.dev.log file usually obtains the same effect as that of registry. The system log in Windows 7 eventlogincreasestheaudittoUSBdevices.ItrecordstheunloadinginformationofUSBdevices.TheshortcutfilesinRecentfoldercontain the target file attributes and users’ operation inform
您可能关注的文档
- Understanding by Design:理解设计.ppt
- Understanding the Micro and Macro Environment了解宏观环境和微观环境.ppt
- Understanding the Hazard Communication Standard:了解危险通讯标准.ppt
- UG NX 运动仿真 实例练习-齿轮传动.pptx
- Unit threeWhat would you like说课稿.doc
- UPR生产状况调查.doc
- UniMap 原理與簡介.pptx
- Uncle Bill童装品牌加盟介绍官方文案.ppt
- UPVC排水管道安装工程施工质量技术交底.doc
- UPVC管道施工方案.doc
文档评论(0)