基于windows平台的计算机隐秘取证系统的分析与实现-analysis and implementation of computer covert forensics system based on windows platform.docxVIP

易流失、易破坏、易销毁的电子证据进行取证的重点需求，并且要求取证过程具有隐蔽性、可靠性、实时性和自动性等性能，并以自顶向下的 方式对该系统进行设计。随后，根据设计中所遇到技术问题进行深入研 究，这些关键技术包括：程序自启动技术、进程隐藏技术、移动设备监 控技术、文件加密技术、文件隐藏技术以及隐秘通信技术等。然后，以 设计方案为框架，对该系统进行了具体实现，介绍了重要的数据结构和 主要功能接口。并且对该系统进行了功能测试，并分析了该系统特性。 经测试验证该系统达到了功能需求所提出的技术指标以及隐蔽性、可靠 性、实时性和自动性等性能要求。最后，从计算机技术和法学相结合的角度，对该系统的进一步升级 和以后的工作方向做出了总结和分析。关键词：计算机取证，电子证据，动态取证，文件加密，隧道技术The Research and Implementation of Secret Computer Forensics System Based on the Windows PlatformABSTRACTThe 21st century is an information age due to the rapid development of computer science and technology. While people benefit from the information technology, the crimes involved with computer and network are more and more rampant. Computer and cyber crimes are considered as the most destructive crime type in the 21st century. The distinguishing features of computer and cyber crimes are high-tech, highly intelligent and highly complex.From a legal point of view, the evidence is the key core of cases detecting. Excavation and collection of the electronic evidence of the computer and cyber crimes is the core of computer forensics. Computer forensics focuses on the research of obtaining, conserving, analysising and producing the electronic evidence of computer and cyber crimes. Computer forensics is not only a computer technology but also a legal norm, and it is a powerful weapon to combat and prevent computer crimes.Based on the problems in the actual process of computer forensics，andthrough searching large amounts of material and technical research，a secret computer dynamic forensics system in Windows platform is proposed.Firstly, the development situation and achievement of computer forensics technology both inside and outside our country is introduced, and then the definition, principles and procedure of computer forensics are discussed in detail. Besides, the definition, features, and legal status of electronic evidenceare explained.Secondly, the design and impelementation of a computer dynamic secret forensics system is t