基于安全操作系统的电子证据获取与存储-CiteSeerX.PDF

ISSN 1000-9825, CODEN RUXUEW E-mail: jos@ Journal of Software, Vol.18, No.7, July 2007, pp .1715− 1729 http://www.j DOI: 10. 1360/jos1 81715 Tel/Fax : +86-10 © 2007 by Journal of Software. All rights reserved. ∗ 基于安全操作系统的电子证据获取与存储 1,2,3+ 1,3 1,4 丁丽萍 , 周博文 , 王永吉 1( 中国科学院 软件研究所 互联网软件技术实验室,北京 100080) 2(北京警察学院,北京 102202) 3( 中国科学院 研究生院,北京 100049) 4( 中国科学院 软件研究所 计算机科学重点实验室,北京 100080) Capture and Storage of Digital Evidence Based on Security Operating System DING Li-Ping1,2,3+, ZHOU Bo-Wen1,3, WANG Yong-Ji1,4 1(Laboratory for Internet Software Technologies, Institute of Software, The Chinese Academy of Sciences, Beijing 100080, China) 2(Beijing Police College, Beijing 102202, China) 3(Graduate University, The Chinese Academy of Sciences, Beijing 100049, China) 4(State Key Laboratory for Computer Science, Institute of Software, The Chinese Academy of Sciences, Beijing 100080, China) + Corresponding author: Phn: +86-10 Fax: +86-10 E-mail: dingliping@ Ding LP, Zhou BW, Wang YJ. Capture and storage of digital evidence based on security operating system. Journal of Software, 2007,18(7):1715−1729. /1000-9825/18/1715.htm Abstract: In this paper, a kind of security operating system with the mechanism of real-time forensics (called SeFOS) is presented, the general architecture of SeFOS is described, the model of its forensics behaviors is analyzed with some formal method descriptions, and the method of completely collecting and safely storing for the digital evidences is presented. The forensics model of SeFOS is inside the kernel and the evide