计算机取证中关键技术分析-计算机应用技术专业论文.docxVIP

第 第 PAGE IV 页 第 第 III 页 往的一些经典计算机取证模型加以分析，提出了一种基于瀑布流模型 的计算机取证过程模型；针对计算机取证流程抽象网络的研究，提出 了对取证结果进行可信度划分的方法，并给出了概率论上的证明。 关键词：计算机取证，数据恢复，模式匹配，文件格式分析，取证模 型 上海交通大学工学硕士学位论文AB 上海交通大学工学硕士学位论文 ABSTRACT 上海交通大学工学硕士学位论文AB 上海交通大学工学硕士学位论文 ABSTRACT Research On Key Technology of Computer Forensics ABSTRACT In recent years, the problems that brought by computer-related crime became mor.e and more serious Since the breaking out of “Xiongmao Shaoxiang” virus, the society was paying increasing attention to computer-related crime. Meanwhile, the computer forensic technology , which is a key method of crime-fighting, also gradually becomes a research focus in this industry. In China, the China Computer Forensics Conference(CCFC), organized by China Computer Forensics Research Center, has held large-scale activities for three times, which contributed a lot to the academic exchanges of technicians in this industry. In this paper, we embarks from the needs of actual computer forensic cases, and studies some key technology in computer forensics as following. First, data recovery technology. This technology is one of the most frequently used technologies in computer forensics. This article starts from the structure of FAT32 and the NTFS file system, and analyzes the principle of recovering a deleted file and rebuilding formatted file system. Then a normal method is stated to deal with file recovery and file system rebuilding after formatted. Second, disk full-text searching technology. While the existing tools cannot satisfy the needs of concrete forensic cases, we propose a common forensic method that uses full-text searching technology to get digital evidences. Meanwhile, in this paper we improved the pattern matching algorithms by comparing the searching speeds under various conditions, and found out a best algorithm to apply to our forensic platform. This method, combining with data recovery technology, can achieve the goal of getting digital evidences by file types, file name or e