计算机取证分析
简述计算机取证的步骤
简述计算机取证的步骤计算机取证是指通过收集和分析数字证据，来获取与计算机相关的犯罪行为的证据。
它是一项重要的技术，用于调查网络犯罪、数据泄露和计算机滥用等问题。
下面将介绍计算机取证的主要步骤。
第一步：确定取证目标在进行计算机取证之前，首先需要明确取证的目标。
这可以是调查一个特定的犯罪行为，或者是查找特定的数字证据。
明确取证目标有助于指导后续的取证工作，并提高取证的效率和准确性。
第二步：收集证据收集证据是计算机取证的核心步骤。
可以通过多种方式收集证据，包括镜像硬盘、复制文件、抓取网络数据包等。
在收集证据时，需要确保采取的方法不会影响到原始数据的完整性和可靠性。
另外，为了保证证据的可信度，应该详细记录每一步的操作过程，并保留相关的日志文件和报告。
第三步：分析证据在收集完证据后，需要对其进行分析。
这包括对收集到的文件、日志、网络数据包等进行深入研究和解读，以找出与取证目标相关的信息。
在分析证据时，可以借助各种取证工具和技术，如数据恢复、关键字搜索、文件比对等。
分析证据的过程中，需要保持严谨和客观，确保结论的准确性和可靠性。
第四步：提取证据在分析证据的过程中，可能会发现一些与取证目标相关的信息。
这些信息需要被提取出来，以供后续的调查和审核。
提取证据的方式可以根据具体情况而定，可以是复制到外部存储设备，也可以是生成报告和摘要。
无论采用何种方式，都需要确保提取的证据完整、可靠，并且符合法律和法规的要求。
第五步：制作取证报告制作取证报告是计算机取证的最后一步。
取证报告是对整个取证过程的总结和归纳，需要清晰、详细地记录取证的目标、过程、结果和结论。
取证报告应该包括所有的关键信息和证据，以便于后续的调查和审查。
同时，取证报告还应该遵循相关的法律和法规要求，确保其合法性和有效性。
计算机取证的主要步骤包括确定取证目标、收集证据、分析证据、提取证据和制作取证报告。
这些步骤需要有专业的技术和方法支持，并且需要严格遵循法律和法规的要求。
计算机取证分析
摘要信息技术的不断发展给人们的生活带来了巨大的改变，网络已经越来越渗透到人们的现实生活与工作当中。
然而，网络在为人民生活和工作带来便利的同时，也引发了无数网络犯罪。
计算机静态取证便是针对网络犯罪而岀现的一种电子取证技术，而随着网络犯罪形式和手段的千变万化，计算机静态取证已不能满足打击网络犯罪的需求，为适应信息化发展的要求，建立安全网络环境和严厉打击网络犯罪行为势在必行，本论文针对计算机动态取证技术进行分析，主要浅谈电子动态取证采集系统的实现、网络证据收集和网络数据分析等几个方面。
通过对计算机取证基本概念、特点和技术的基础研究，对计算机动态取证进行分析。
关键词：电子取证动态取证动态电子证据采集网络数据协议目录、概述（一）、研究背景目前，人类社会已经迈入了网络时代，计算机与互联网已经与老百姓的日常工作、学习与工作息息相关，社会信息化对政治、经济、文化和科技等各项社会生活产生了深远的影响。
然而，网络技术给人类社会带来有利影响的同时，也带来了负面的影响。
在国外，1988年11月美国国防部的军用九三级网络遭受莫里斯病毒袭击，致使美国Internet 网络上6000多台计算机感染，直接经济损失9600万美元。
2000年5月，“爱虫”病毒通过电子邮件传播，在世界各地迅速蔓延，造成全世界空前的计算机系统破坏。
而在国内，人们利用计算机网络犯罪的案例也层出不穷。
2002 年，作案人吕薜文通过盗用他人账号，对中国公众多媒体通信网广州主机进行了攻击，并对其部分文件进行删除、修改、增加等一系列非法操作，造成严重后果。
2008年4月，作案人赵哲窜至上海某证券攻击营业部，利用该营业部电脑安全防范上的漏洞，修改该营业部部分股票交易数据，致使股价短时间内剧烈震荡。
计算机以及其他信息设备越来越多的被运用到犯罪活动中，尽管随着入侵检测系统的广泛使用降低了非法使用计算机资源所带来的损失，但网络犯罪依然不可忽视。
针对网络环境安全，本文旨在研究探讨网络开放环境下的电子证据的动态收集与分析。
计算机取证与分析鉴定
2）消除冲突 3）排除假象
4）创建证据链和事件时间线
5）分析过程中不仅要记录发现了什么，更要记录是如
何发现的。 6）用证据证明每一个假设
证据获取 网络取证应用技术
IP地址获取技术 电子邮件的取证技术 网络输入输出系统取证技术 网络入侵跟踪技术 人工智能和数据挖掘技术 IDS 取证技术 蜜阱取证技术 恶意代码技术 入侵容忍技术 网络监控和传感器技术 网络透视技术 Agent技术 SVM取证技术
件数据外，还要特别注意对日志文件数据的处理。
日志信息是证据的重要组成部分，包含许多系统被攻击
过程的历史记录，通过对主机日志系统的分析，可以发 现许多证据信息。
因为入侵者的行为都是与计算机的各种操作紧密相关，
会在系统日志中留下相应的记录。
通过分析，可以了解哪些远程主机访问了本地主机，在
入侵过程中执行了哪些操作等信息，重点是分析以下的 日志信息。
证据获取 黑客的攻击步骤
1）信息收集(Information gathering)：攻击者事先汇
集目标的信息，进行知识和情报准备以及策划，此时 尚未触及受害者； 2）踩点(Footprinting)：扫描目标系统，对其网络结 构、网络组成、接入方式等进行探测； 3）查点(Enumerating)：搜索目标系统上的用户和用 户组名、路由表、共享资源、SNMP信息等； 4）探测弱点(Probing for weaknesses)：尝试目标主机 的弱点、漏洞；
取证工具 概述
网络犯罪都是以二进制编码表示、以高度精密和隐蔽
的数字信号方式存在，而数字信号的易受损性和非连 续特征，使任何人为因素或外力造成的对数据的修改 、剪接、合成、删除、覆盖等操作，从技术上是很难 分辨的
计算机取证技术的运用分析
中 国 管 理 信 息 化
Ｃｈ ｎ ａ ａ ｅ ｎ ｎｏ ｍ ａｉｎ ｚ ｔ ｎ ｉ ａＭ ｎ ｇ ｍｅ ｔ ｆｒ ｔ ｉａｉ Ｉ ｏ ｏ
Ｆ ｂ ， ０１ ｅ ．２ ２
Ｖｏ ＿ ５． ４ ｌ１ Ｎｏ．
第 ｌ 卷第 ４ ５ 期
计算机取证技术的运用分析
顾 艳 林
（ 内蒙古 财经 学院职 业学 院 计算机 系 ， 浩特 ０ ０ ５ ） 呼和 １０ １
［ 摘
一
要］ 文基 于 工作 经验 ， 析 了计 算 机 取 证技 术在 侦 查 网络 犯 罪 中运 用 的现 状 ， 出 了计 算机 取证 技 术运 用 中存 在 的 本 分 指
些 问题 。 着 重介 绍 了增 强 运 用 意 识 ， 及 理 论 知 － ， 并 普 ／ 发展 取 证 技 术 ， 养 专 业 人 才 ， 范 取 证 过 程 ， 全 相 关 法 律 等 多 ｇ ， 培 规 健
１ 技 术 发 展 乏 力 ． 业 人 才 缺 乏 ． ２ 专
但 是 与 国 外 的一 些 国家 相 比 仍 然 存 在 着 相 当 大 的差 距 ， 此 ． 为 有
术 能 够尽 快 地 、 效 地 运 用 到 社 会 生 活 中 。 有 １ 计 算 机 取 证 技 术 运 用 的 现状
当前 计 算 机 取 证 技 术 在 我 国 司法 领 域 还 没 有 得 到 有 效 的运 子 取 证 技 术 的作 用 需 要 不 断 地 发 展 计 算 机 取 证 技 术 ． 很 多 有 用 但 用 ．综 合 相 关 信 息 主要 是 因 为 我 国相 关 部 门 还 没 有 引 起 足 够 的 重 视 ．特 别 是 对 计 算 机 取 证 是 否 合 乎 法 律 能 否 成 为 法 庭 上 的有 计 算 机 取证 技术 按 是 否 与 网络 连 接 为分 类 标 准 ． 大体 包 括 两种 取 力 证 据 还 存 在 着 相 当大 的 争 论 由 于 在 对 取 证 技 术 的 认 识 上 存 证 技 术 ． 种 是 基 于 单 机 的 计 算 机 取 证 技 术 ， 一 种 就 是 基 于 网 一 另 在着 一 定 的偏 差 且 该 项 技 术 还 没 有 得 到 充 分 的发 展 ． 因此 要 积
计算机取证与分析步骤
计算机取证与分析步骤1、关闭计算机2、记录（拍照）嫌疑计算机硬件配置与状态3、将嫌疑计算机转移至安全地点4、对硬盘或软盘做位对位获取5、对存储介质中的数据做验证6、记录系统日期和时间7、确定关键字符清单8、分析Windows Swap交换文件9、分析文件残留区File Slack10、分析未分配空间11、在文件、文件残留区、未分配空间中搜索关键字符12、记录文件名、日期、时间13、Computer Evidence Processing StepsNTI conducts hands-on computer forensics training courses which expose computer professionals to the many hazzards and risks associated with computer evidence processing and computer security. NTI's computer forensics training courses designed to drive home several important points, i.e., computer evidence is fragile by its very nature and the problem is compounded by the potential for destructive programs and hidden data.Even the normal operation of the computer can destroy computer evidence that might be lurking in temporary operating system files, temporary application working files and ambient data storage areas. NTI provides its training clients with a solid foundation built upon technical knowledge so that they will understand the technical issues concerning the creation, modification and storage of computer data. Without this knowledge they will be unable to testify about their computer forensic findings. NTI also wants its clients to have a complete understanding of the technical issues so that they can make the right decisions about computer security risk management and computer evidence processing issues. It is not enough to run a computer forensics program and get results. Good decisions are made by knowledgable individuals who understand the underlying tec hnical issues tied to the potential security risks and evidence processing issues tied to personal computers.There are no strict rules that must be followed concerning the processing of computer evidence. Every case is different and flexibility and good technical knowledge make the difference between success and failure. However, many times decisions need to be made without full the knowledge of the issues involved. For that reason NTI has provided the following guidelines which are intended to assist its clients. Please remember that these guidelines do not represent 'the only true way'. They are intended to be general guidelines which are provided as food for thought. If you have an emergency and you are not yet formally trained, click here for emergency guidelines.General evidence processing guidelines follow:1. Shut Down the ComputerDepending upon the computer operating system involved, this usually involves pulling the plug or shutting down a net work computer using relevant operating system commands. At the option of the computer specialists, pictures of the screen image can be taken using a camera. However, consideration should be given to possible destructive processes that may be operating in the background. These can be resident in memory or available through a modem or network connection. Depending upon the operating system involved, a time delayed password protected screen saver may potentially kick in at any moment. This can complicate the shutdown of the computer. Generally, time is of the essence and the computer system should be shut down or powered down as quickly as possible.2. Document the Hardware Configuration of The SystemIt is assumed that the computer system will be moved to a secure location where a proper chain of custody can be maintained and the processing of evidence can begin. Before dismantling the computer, it is important that pictures are taken of the computer from all angles to document the system hardware components and how they are connected. Labeling each wire is also important so that the original computer configuration can be restored. Computer evidence should ideally be processed in a computer hardware environment that is identical to the original hardware configuration.3. Transport the Computer System to A Secure LocationThis may seem basic but all too often seized evidence computers are stored in less than secure locations. It is imperative that the subject computer is treated as evidence and it should be stored out of reach of curious computer users. All too often, individuals operate seized computers without knowing that they are destroying potential computer evidence and the chain of custody. Furthermore, a seized computer left unintended can easily be compromised. Evidence can be planted on it and crucial evidence can be intentionally destroyed. A lack of a proper chain of custody can 'make the day' for a savvy defense attorney. Lacking a proper chain of custody, how can you say that relevant evidence was not planted on the computer after the seizure? The answer is that you cannot. Do not leave the computer unattended unless it is locked in a secure location! NTI provides a program named Seized to law enforcement computer specialists free of charge. It is also made available to NTI's business and government in various suites of software that are available for purchase. The program is simple but very effective in locking the seized computer and warning the computer operator that the computer contains evidence and should not be operated. Click here for information about NTI's software suites or click here for the law enforcement order form.4. Make Bit Stream Backups of Hard Disks and Floppy DisksThe computer should not be operated and computer evidence should not be processed until bit stream backups have been made of all hard disk drives and floppy disks. All evidence processingshould be done on a restored copy of the bit stream backup rather than on the original computer. The original evidence should be left untouched unless compelling circumstances exist. Preservation of computer evidence is vitally important. It is fragile and can easily be altered or destroyed. Often such alteration or destruction of data is irreversible. Bit stream backups are much like an insurance policy and they are essential for any serious computer evidence processing. More information about bit stream backups has been provided on this site. Click here for the article about making bit stream backups. In March 2000, NTI purchased SafeBack software from Sydex, Inc. This is a very popular bit stream backup tool that has become an international standard since 1991. NTI covers the use of this software in its computer forensics training courses.5. Mathematically Authenticate Data on All Storage DevicesY ou want to be able to prove that you did not alter any of the evidence after the computer came into your possession. Such proof will help you rebut allegations that you changed or altered the original evidence. Since 1989, law enforcement and military agencies have used a 32 bit mathematical process to do the authentication process. Mathematically, a 32 bit data validation is accurate to approximately one in 4.3 billion. However, given the speed of today's computers and the vast amount of storage capacity on today's computer hard disk drives, this level of accuracy is no longer accurate enough. A 32 bit CRC can easily be compromised. Therefore, NTI includes two programs in its forensic suites of tools that mathematically authenticate data with a high level of accuracy. Large hashing number, provides a mathematical level of accuracy that is beyond question. These programs are used to authenticate data at both a physical level and a logical level. The programs are called CrcMD5 and DiskSig Pro. The latter program was specifically designed to validate a restored bit stream backup and it is made available free of charge to law enforcement computer specialists as part of NTI's Free Law Enforcement Suite. The programs are also included in our various suites of forensic software which are sold NTI's clients.6. Document the System Date and TimeThe dates and times associated with computer files can be extremely important from an evidence standpoint. However, the accuracy of the dates and times is just as important. If the system clock is one hour slow because of daylight-saving time, then file time stamps will also reflect the wrong time. To adjust for these inaccuracies, documenting the system date and time settings at the time the computer is taken into evidence is essential. NTI has created a program called GetTime which is used for this purpose. It is included in the NTI various suite of tools.7. Make a List of Key Search WordsBecause modern hard disk drives are so voluminous, it is all but impossible for a computer specialist to manually view and evaluate every file on a computer hard disk drive. Therefore, state-of-the-art automated forensic text search tools are needed to help find the relevant evidence. One such tool is NTI's TextSearch NT which is certified for use by the U. S. Department of Defense. Usually, some information is known about the allegations in the case, the computer user and the alleged associates that may be involved. Gathering information from individuals familiar with the case to help compile a list of relevant key words is important. Such key words can be used in the search all computer hard disk drives and floppy diskettes using automated software. Keeping the list as short as possible is important and you should avoid using common words orwords that make up part of other words. In such cases, the words should be surrounded with spaces. Intelligent filtering tools can also be helpful in crafting lists of key words for use in computer evidence processing, e.g., NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML.8. Evaluate the Windows Swap FileThe Windows swap file is potentially a valuable source of evidence and leads. The evaluation of the swap file can be automated with several of NTI's forensic tools, e.g., NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML. These intelligent filters automatically identifies patterns of English language text, phone numbers, social security numbers, credit card numbers, Internet E-Mail addresses, Internet web addresses and names of people.In the past this tedious task of analyzing Windows swap files was done with hex editors and the process took days to evaluate just one Windows swap file. By using automated tools, that process now takes just a few minutes. When Windows 95/98 is involved, the swap file may be set to be dynamically created as the computer is operated. This is the default setting and when the computer is turned off, the swap file is erased. However, not all is lost because the content of the swap file can easily be captured and evaluated by NTI's GetFree program. This program automatically captures erased file space and creates a file that can be evaluated by NTI's various intelligent filter programs mentioned above.The NTA Stealth program relies upon artificial intelligence fuzzy logic to identify patterns of text associated with past Internet activities. This program is used by probation and parole officers to montior the computer and Internet activity of convicted sex offenders. It is also used in corporations to identify inappropriate uses of computers in the workplace and it is used in law enforcement and military agencies.The output from NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML. can be successfully used to identify 'unknown key words' that can supplement the key word list created in the step above. The automated review of the Windows swap file takes just a few minutes with these automated tools. A manual review of the Windows swap file can take days or even weeks if the process is done manually using programs like the Norton utilities.9. Evaluate File SlackFile slack is a data storage area of which most computer users are unaware. It is a source of significant 'security leakage' and consists of raw memory dumps that occur during the work session as files are closed. The data dumped from memory ends up being stored at the end of allocated files, beyond the reach or the view of the computer user. Specialized forensic tools are required to view and evaluate file slack and it can prove to provide a wealth of information and investigative leads. Like the Windows swap file, this source of ambient data can help provide relevant key words and leads that may have previously been unknown.On a well used hard disk drive, as much as 900 million bytes of storage space may be occupied by file slack. File slack should be evaluated for relevant key words to supplement the keywords identified in the steps above. Such keywords should be added to the computer investigator's list ofkey words for use later. Because of the nature of file slack, specialized and automated forensic tools are required for evaluation. NTI has created a forensic utility called GetSlack that captures file slack from hard disk drives and floppy disks. The output from the GetSlack program can be evaluated in the same fashion as a Windows swap file using the intelligent filter programs listed above. File slack is typically a good source of Internet leads.10. Evaluate Unallocated Space (Erased Files)The DOS and Windows 'delete' function does not completely erase file names or file content. Many computer users are unaware the storage space associated with such files merely becomes unallocated and available to be overwritten with new files. Unallocated space is a source of significant 'security leakage' and it potentially contains erased files and file slack associated with the erased files. Often the DOS Undelete program can be used to restore the previously erased files. Like the Windows swap file and file slack, this source of ambient data can help provide relevant key words and leads that may have previously been unknown to the computer investigator. On a well used hard disk drive, millions of bytes of storage space may contain data associated with previously erased files. Unallocated space should be evaluated for relevant key words to supplement the keywords identified in the steps above. Such keywords should be added to the computer investigator's list of key words for use in the next processing step. Because of the nature of data contained in unallocated space and its volume, specialized and automated forensic tools are required for evaluation. NTI has created a forensic utility called GetFree that quickly captures all unallocated space from hard disk drives and floppy disks. The output from the GetFree program can be evaluated in the same fashion as the other types of ambient data mentioned previously using intelligent filter programs. Unallocated space is typically a good source of data that was previously associated with word processing temporary files and other temporary files created by various computer applications. It is also a good source of leads concerning graphics files that have been viewed over the Internet and NTI's GExtract software can be used very effectively to identify these graphic file remnants left behind in unallocated storage space.11. Search Files, File Slack and Unallocated Space for Key WordsThe list of relevant key words identified in the previous steps should be used to search all relevant computer hard disk drives and floppy diskettes. There are several forensic text search utilities available in the marketplace. NTI's forensic search TextSearch NT can be used for that purpose and it has been tested and certified for accuracy by the U. S. Department of Defense. This powerful search tool is also included as part of NTI's suites of software tools. It was designed to be a state-of-the-art search tool for use as a security review tool by U. S. government intelligence agencies. This program and other NTI forensic tools also provide significant benefits in cases involving computer related evidence. For this reason and to help stretch limited law enforcement budgets, NTI makes all of its forensic software tools and training available to law enforcement computer crime specialists for discounted prices.It is important to review the output of a forensic text search utility. When relevant evidence or leads are identified, the fact should be noted and the identified data should be documented. When new key words are identified in the searching process, then they should be added to the list and anew search should be conducted using the text search utility again with the updated search list. Text search utilities are also used, on a regular basis, in classified government agencies for security reviews. When evidence or unexpected findings are uncovered in government security reviews, they should also be documented and archived as potential evidence. NTI's TextSearch NT is certified by the U. S. Department of Defense and its little brother, TextSearch Plus has been used for years in classified U. S. government agencies to process evidence and to conduct computer security reviews.12. Document File Names, Dates and TimesFrom an evidence standpoint, file names, creation dates, last modified dates and times can be relevant. Therefore, it is important to catalog all allocated and 'erased' files. NTI includes a program called FileList Pro in its various suites of forensic tools. The FileList Pro program generates its output in the form of a database file. The file can be sorted based on the file name, file size, file content, creation date, last modified date and time. Such sorted information can provide a timeline of computer usage. When FileList Pro created databases can be combined from several computers in the same case and the sorted output can provide conspiratorial leads for further investigation. This powerful inventory tool is used to evaluate all Microsoft-based computer systems in computer related investigations.NTI also created another forensic documentation tool called NTIDOC. This program is used to take electronic snapshots of relevant computer files. The program automatically records the file name, time and date along with relevant file attributes. The output is in the form of a word processing compatible file that can be used to help document computer evidence issues tied to specific files.13. Identify File, Program and Storage AnomaliesEncrypted, compressed and graphic files store data in binary format. As a result, text data stored in these file formats cannot be identified by a text search program. Manual evaluation of these files is required and in the case of encrypted files, much work may be involved. NTI's TextSearch Plus program has built in features that automatically identify the most common compressed and graphic file formats. The use of this feature will help identify files that require detailed manual evaluation. Depending on the type of file involved, the contents should be viewed and evaluated for its potential as evidence.Reviewing the partitioning on seized hard disk drives is also important. The potential exists for hidden partitions and/or partitions formatted with other than a DOS compatible operating system. When this situation exists it is comparable to finding a hidden hard disk drive and volumes of data and potential evidence can be involved. The partitioning can be checked with any number of utilities including the DOS FDISK program or Partition Magic. When hidden partitions are found, they should be evaluated for evidence and their existence should be documented.If Windows is involved, it makes sense to evaluate the files contained in the Recycle Bin. The Recycle Bin is the repository of files selected for deletion by the computer user. The fac t that they have been selected for deletion may have some relevance from an evidentiary standpoint. Ifrelevant files are found, the issues involved should be documented throughly.14. Evaluate Program FunctionalityDepending on the application software involved, running programs to learn their purpose may be necessary. NTI's training courses make this point by exposing the students to computer applications that do more than the anticipated task. When destructive processes are discovered that are tied to relevant evidence, this can be used to prove willfulness. Such destructive processes can be tied to 'hot keys' or the execution of common operating commands tied to the operating system or applications. Before and after comparisons can be made using the FileList Pro program and/or mathematical authentication programs. All these tools are included in most of NTI's suites of forensic tools15. Document Y our FindingsAs indicated in the preceding steps, it is important to document your findings as issues are identified and as evidence is found. Documenting all of the software used in your forensic evaluation of the evidence including the version numbers of the programs used is also important. Be sure that you are legally licensed to use the forensic software. Software pirates do not stand up well under the riggers of a trial. Smart defense lawyers will usually question software licensing and you don't want to testify that you used unlicensed software in the processing of computer evidence. Technically, software piracy is a criminal violation of federal copyright laws.When appropriate, mention in your documentation that you are licensed to use the forensic software involved. With NTI's software, a trail of documentation is automatically created for the computer investigator and the name of the licensed user is listed in most output files. This feature aids in establishing who did the processing and the exact time and date when the processing was done. Screen prints of the operating software also help document the version of the software and how it was used to find and/or process the evidence.16. Retain Copies of Software UsedAs part of your documentation process, we recommend that a copy of the software used be included with the output of the forensic tool involved. Normally this is done on an archive Zip disk, Jazz disk or other external storage device, e.g. external hard disk drive. When this documentation methodology is followed, it eliminates confusion at trial time about which version of the software was used to create the output. Often it is necessary to duplicate forensic processing results during or before trial. Duplication of results can be difficult or impossible to achieve, if the software has been upgraded and the original version used was not retained. Please note that there is a high probability that you will encounter this problem because most commercial software is upgraded routinely but it may take years for a case to go to trial.。
计算机取证简析
计算机取证技术简析计算机取证是指能够为法庭接受的、足够可靠和有说服力的、存在于计算机和相关外设中的电子证据的确定、收集、保护、分析、归档以及法庭出示的过程。
计算机取证基本围绕电子证据展开。
电子证据是指在计算机或计算机系统运行过程中产生的，以其记录的内容来证明案件事实的电磁记录物。
电子证据的表现形式是多样的，尤其是多媒体技术的出现，使电子证据综合了文本、图形、图像、动画、音频及视频等多种媒体信息，这种以多媒体形式存在的计算机证据几乎涵盖了所有传统证据类型。
与传统证据一样，电子证据必须是可信的、准确的、完整的、符合法律法规的。
与传统证据相比较，电子证据还具有以下特点：1）脆弱性：由于数据自身的特点导致电子证据易被修改，且不易留痕迹；2）无形性：计算机数据必须借助于输出设备才能呈现结果；3）高科技性：证据的产生、传输、保存都要借助高科技含量的技术与设备；4）人机交互性：电子证据的形成，在不同的环节上有不同的操作人员参与，它们在不同程度上都可能影响电子证据的最终结果；5）电子证据是由计算机和电信技术引起的，由于其它技术的不断发展，所以取证步骤和程序必须不断调整以适应技术的进步。
电子证据的来源很多，主要有系统日志、IDS、防火墙、FTP、反病毒软件日志、系统的审计记录、网络监控流量、电子邮箱、操作系统和数据库的临时文件或隐藏文件，数据库的操作记录，硬盘驱动的交换（Swap）分区、实时聊天记录等等。
电子证据的获取方法包括数字鉴定、数据检查、数据对比、数据保护、数据分析和证据抽取。
而这些方法的实施将贯穿整个计算机取证过程。
由于自身的局限性和计算机犯罪手段的变化，特别是反取证软件的出现，现有的取证技术已经不能满足打击犯罪的要求。
随着取证领域的扩大，取证工具将向着专业化和自动化方向发展，并在无线环境下得到进一步应用，如手机、PDA、传真等无线终端设备的取证。
所以，还需要加深对计算机取证方面的知识以及计算机应用才能更有效的实现计算机取证。
简述计算机取证的技术及其过程
简述计算机取证的技术及其过程
计算机取证（Computer Forensics）是一种用于获取、保护和分析在计算机或网络环境中发现的可用作证据的数据的技术。
它是一种针对计算机存在的各种欺诈行为、犯罪行为、不当行为以及各种违反公法的行为而进行的技术支持。
计算机取证是一种复杂的过程，涉及到非常多的技术，它涉及到计算机和网络存储设备的分析、取证和恢复等多个环节。
一般来说，它的流程主要分为以下几个步骤：
1.取证：经过法律手段进入犯罪现场，及时收集相关信息，以及收集、拍摄、测量和鉴定当地存在的物体和环境条件；
2.鉴定：根据收集的物证资料鉴定取证中的计算机设备的制造商、型号、序列号等情况；
3.数据恢复：数据恢复技术可以使损坏的媒体介质上存储的数据恢复可用；
4.数据取证：根据取证计划的要求，从收集的电脑设备中检索需要的相关信息；
5.数据分析：根据取证计划的要求，进行分析技术，以建立案件证据；
6.报告归档：根据案件定性，对取证结果进行实体报告，供警方、检察院、法院以及其他部门使用。
计算机取证工作对专业性要求非常高，取证过程中涉及的法律、技术等都是需要专业人员配合进行的。
取证技术的应用可以非常大程
度上帮助警方侦破各类犯罪，充分发挥计算机取证在司法取证中的重要作用。
计算机取证实验报告(共6篇)
篇一：计算机取证技术实验报告windows平台逻辑层数据恢复一、实验目的：通过运用软件r-studio_5.0和winhex对误格式化的硬盘或者其他设备进行数据恢复，通过实验了解windows平台逻辑层误格式化数据恢复原理，能够深入理解并掌握数据恢复软件的使用方法，并能熟练运用这些软件对存储设备设备进行数据恢复。
二、实验要求：运用软件r-studio_5.0和winhex对电脑磁盘或者自己的u盘中的删除的数据文件进行恢复，对各种文件进行多次尝试，音频文件、系统文件、文档文件等，对简单删除和格式化的磁盘文件分别恢复，并检查和验证恢复结果，分析两个软件的数据恢复功能差异与优势，进一步熟悉存储介质数据修复和恢复方法及过程，提高自身的对存储介质逻辑层恢复技能。
三、实验环境和设备：（1）windows xp 或windows 2000 professional操作系统。
（2）原始硬盘（或u盘）一个，目标硬盘一个。
（3）或者可用u盘（或其他移动介质）和软件r-studio_5.0和winhex安装包。
四、实验内容：（1）熟悉r-studio的操作界面和该软件的使用，掌握该软件的数据恢复方法，并运用该软件按步骤对硬盘或优盘进行逻辑层数据恢复。
（2）熟悉winhex的操作界面和该软件的使用，掌握该软件的数据恢复方法，并运用该软件按步骤对硬盘或优盘进行逻辑层数据恢复。
（3）体会软件进行 windows平台逻辑层数据恢复的运行机制，并进行比较不同的数据恢复方法和原理。
五、实验步骤：（一）使用r-studio软件操作：1．数据恢复。
将要恢复文件的硬盘或者将要恢复文件的独立u盘连在计算机上，打开r-studio软件。
2．打开任意磁盘或者分区，右边显现文件有红色叉的表示删除的文件。
3．勾选该文件，“右击”选择“恢复标记文件”，设置文件输出路径，便可以恢复文件了。
4．点击某分区，右击选择“扫描”，进行“文件系统设置”选项设置后，点击“扫描”开始扫描磁盘5．双击“红色盘符”，然后双击“额外找到的文件”，就可看到此文件系统下的恢复文件 6．右击选择“恢复标记的内容”，设置恢复的路径，此路径不能在此次扫描的磁盘中。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
计算机取证分析内部编号：（YUUT-TBBY-MMUT-URRUY-UOOY-DBUYI-0128）摘要信息技术的不断发展给人们的生活带来了巨大的改变，网络已经越来越渗透到人们的现实生活与工作当中。
然而，网络在为人民生活和工作带来便利的同时，也引发了无数网络犯罪。
计算机静态取证便是针对网络犯罪而出现的一种电子取证技术，而随着网络犯罪形式和手段的千变万化，计算机静态取证已不能满足打击网络犯罪的需求，为适应信息化发展的要求，建立安全网络环境和严厉打击网络犯罪行为势在必行，本论文针对计算机动态取证技术进行分析，主要浅谈电子动态取证采集系统的实现、网络证据收集和网络数据分析等几个方面。
通过对计算机取证基本概念、特点和技术的基础研究，对计算机动态取证进行分析。
关键词：电子取证动态取证动态电子证据采集网络数据协议目录一、概述（一）、研究背景目前，人类社会已经迈入了网络时代，计算机与互联网已经与老百姓的日常工作、学习与工作息息相关，社会信息化对政治、经济、文化和科技等各项社会生活产生了深远的影响。
然而，网络技术给人类社会带来有利影响的同时，也带来了负面的影响。
在国外，1988年11月美国国防部的军用九三级网络遭受莫里斯病毒袭击，致使美国Internet网络上6000多台计算机感染，直接经济损失9600万美元。
2000年5月，“爱虫”病毒通过电子邮件传播，在世界各地迅速蔓延，造成全世界空前的计算机系统破坏。
而在国内，人们利用计算机网络犯罪的案例也层出不穷。
2002年，作案人吕薜文通过盗用他人账号，对中国公众多媒体通信网广州主机进行了攻击，并对其部分文件进行删除、修改、增加等一系列非法操作，造成严重后果。
2008年4月，作案人赵哲窜至上海某证券攻击营业部，利用该营业部电脑安全防范上的漏洞，修改该营业部部分股票交易数据，致使股价短时间内剧烈震荡。
计算机以及其他信息设备越来越多的被运用到犯罪活动中，尽管随着入侵检测系统的广泛使用降低了非法使用计算机资源所带来的损失，但网络犯罪依然不可忽视。
针对网络环境安全，本文旨在研究探讨网络开放环境下的电子证据的动态收集与分析。
（二）、国内外研究现状目前，虽然我国各省市级公安机关有专门的部门处理计算机犯罪案例，然而在处理案件的技术上所用到的只是国外一些常见的取证工具，如今计算机犯罪手段变化多端，这样所获取的电子证据缺乏说服力，未能给破案带来实质性的帮助。
而类似美国等发达国家地区，无论是在电子取证技术上、人们的意识形态和有关计算机证据的法律建设都在于我国之上，许多专门的计算机取证部门、实验室和公司开发了很多极其实用的取证产品。
例如，计算机司法领域的行业领袖Logicube、突出的计算机取证服务提供商ICS、Vogon和Guidance等公司不断研发和推进它们的专业取证产品，对打击计算机犯罪提供了有效的工具。
因此，我国应该自主开发能够有效打击计算机及网络犯罪的专业电子产品，健全相关法律法规，以应对日益增加的犯罪活动，使得用户的权益不受侵犯。
开展计算机取证技术的研究，无疑对我国的社会发展乃至整个世界的计算机科学发展都有着极其重要的意义。
（三）、论文研究内容与时俱进的时代性不仅体现在社会与经济的快速发展，同时体现于社会各个领域的全面进步，计算机取证已经成为当今社会不可置旁的话题，执法机关对计算机取证技术的要求也越来越高，本文将通过对计算机取证技术的基础知识进行拓展，比计算机静态取证做更进一步的探讨，对动态电子证据采集系统的实现进行研究以及对计算机证据的收集和分析研究。
本文各部分的内容组织如下：第一章概述，介绍课题的研究背景，以及国内外关于计算机取证的发展现状和本课题的主要研究内容。
第二章计算机取证技术，较系统介绍计算机取证的定义、特点、基本原则和简单介绍比较计算机动态取证和计算机静态取证。
第三章计算机动态取证采集系统的实现研究，分析计算机动态取证采集系统的功能，从而研究计算机动态取证采集系统的组成。
第四章计算机证据收集与分析，讨论网路数据的分析和网络证据的收集。
最后结语，对本论文进行总结。
二、计算机取证技术（一）、计算机取证的定义计算机取证即对计算机入侵与犯罪，进行证据获取、保存、分析和出示，它是一个对受侵计算机系统进行扫描和破解，以对入侵事件进行重建的过程。
计算机取证包括物理证据获取和信息发现两个阶段。
物理证据获取是指调查人员到计算机入侵或者犯罪现场寻找以及扣留计算机硬件，而信息发现则指专业人员从原始电子数据（包括日志、文件等）中寻找破案所需要的电子证据。
计算机取证对计算机和网络犯罪的作用至关重要，执着证据真实、可靠、完整和符合法律法规的原则，它被用于解决现代社会中出现的许多计算机和网络犯罪活动。
（二）、计算机取证的特点电子证据是以电或磁的脉冲形式和二进制的数据格式存储于计算机的硬盘上的高科技证据，它与传统的证据相比具有高科技性、无形性和易破坏性等特点。
高科技性是指电子证据的产生、储存和传输，都必须借助于、存储技术、网络技术等，离开了相应技术设备，电子证据就无法保存和传输。
无形性是指电子证据肉眼不能够直接可见的，必须借助适当的工具。
易破坏性是指电子证据很容易被篡改、删除而不留任何痕迹。
根据电子证据的特点，获取对计算机系统进行彻检，进而提取以及保护计算机和网络犯罪的证据。
在电子证据获取的过程中，需要保持及时性、无破坏性、连续性和受监督性。
及时性和无破坏性是指要尽早地搜集证据，而保证证据完整不受破坏；连续性是指在取证过程中必须保证证据的连续性，以保全其具备的证据能力和证明力；受监督性是指原告委派的专家的整个检查和取证工作，都应该受到由其它方委派的专家的监督。
（三）、计算机取证的基本原则计算机取证的基本原则主要有以下几点：首先，保持及时的原则，对证据要及时搜集，以免错过取证的最佳时段；其次，保全证据，保持证据完整而不受损坏；第三，必须保持证据的连续性，将证据提交给法庭时，必须能够说明证据从获取至提交法庭整个过程的证据状态是否出现变化，或者没有任何变化。
最后，原告委派的专家的整个检查和取证工作，都应该受到由其它方委派的专家的监督。
（四）、计算机取证技术按计算机取证发生时间的不同，将计算机取证分为事后的静态取证和实时的动态取证。
静态取证的电子取证的证明力相对较低，事后的取证使取证工作处于被动的状态，取证工作很大程度上受限于计算机犯罪分子留下的现场，从而难以对付计算机犯罪。
而计算机动态取证是将取证技术结合到防火墙和入侵检测中，对所有可能的计算机犯罪行为进行实时数据获取和分析，智能分析入侵者的企图，采取措施切断链接或诱敌深入，在确保系统安全的情况下获取大量的证据，并保全、分析和提交证据的过程。
动态取证较静态取证的优越性在于动态取证在时间上具有实时性，一般在网络入侵发生时便开始启动，这样所提取的证据相对比较充分和完整，同时，证据的有效性也变得更强。
另外，动态取证对于取证人员的要求相对较低，而不像静态取证工具种类繁多，取证操作过程繁琐，技术单一。
三、计算机动态取证采集系统的实现研究（一）、计算机动态取证采集系统功能针对网络犯罪日益严重的现象，动态电子证据采集技术在电子取证技术中起着举足轻重的地位，动态电子证据采集技术包括IP地址和MAC地址获取和识别技术、数据包捕获技术、身份认证技术、漏洞扫描技术、电子邮件的取证和坚定技术等。
为能够有效对网络入侵犯罪活动进行证据采集，计算机动态取证采集系统必须具备以下功能：首先，系统能够检测本地互联网各系统配置的正确性和安全漏洞，监视和分析互联网用户和系统的活动，预防系统被越权操作；其次，能够跟踪所有网络活动和对应用层协议会话过程进行实时与历史重现；最后，能够完整、及时和有效采集电子证据。
采集的信息可以实施全面分析，提取与案件相关的证据。
（二）、计算机动态取证采集系统组成计算机动态取证采集系统组成主要包括：事件采集模块，事件分析模块，事件数据库，安全预警模型和响应单元。
事件采集模块，负责完成从整个网络环境中获得事件，并向系统的其他部分提供此事件。
此处的事件并非所收集的原始的信息，而是将采集到的原始信息经过一定的处理，如过滤、重组，组合等，最终产生和实现功能相关的事件。
事件分析模块，从事件采集模块接受数据，进行分析，并产生新的数据传给其他组件。
分析模块可以是一个轮廓描述工具，统计性地检查现在的事件是否可能与以前某个事件来自同一个时间序列；也可以是一个特征检测工具，用于在一个事件中检测是否有已知的滥用攻击特征；此外，事件分析器还可以是一个相关器，观察事件之间的关系，将有联系的事件放在一起，以利于以后的进一步分析。
事件数据库，存放各种中间很最终数据的地方的统称，它可以是复杂的数据库，也可以是简单的文件文本。
安全预警模型，通过事件分析模块提供的各种统计结果、审计数据以及标准的规则建立入侵检测的安全预警模型，用于对网络数据进行监测，并将报警信息发送给响应单元。
响应单元，处理事件分析模块传送过来的状态信息或其它信息，并据此采取相应的措施，如杀死相关的程序、将连接复位、修改文件权限等。
（三）、计算机动态取证采集系统的体系结构计算机动态取证采集系统为专门加强网络核心部安全性的一种安全预警系统，根据其组成，设计动态电子证据采集系统结构如图1所示：图1 动态电子取证采集系统结构计算机动态取证采集系统由事件采集模块、事件分析模块、事件数据库、预警模型和事件响应和结果处理模块组成。
事件采集模块采用NetFlow技术采集数据，并将采集的原始数据存入数据库；事件分析模块采用基于统计的分析方法，将数据进行基于流量和协议的统计分析，采用数据挖掘方法建立数据仓库；预警模块是有原始报文、流量统计值和流量告警值生成异常检测模型，进行事件告警；事件响应和结果处理模块用于处理告警信息，另外，结果处理模块还可以定期生成统计报表，并反馈给事件分析模块，用来同台的调整安全预警模型。
四、计算机证据收集与分析（一）、网络证据的收集网络犯罪时，无论是利用哪种攻击方法，攻击行为都是在网络上传输通信数据，到达入侵的目的系统。
只要将攻击行为在网上传输的通信数据利用事件采集模块采集下来，用事件分析模块分析后，将其保存下来作为网络犯罪的证据。
1、网络数据收集的理论基础我们在前面一章讲到了计算机动态取证采集系统的相关知识，在共享型以太网中，所有的通讯都是广播的，同一网段中的所有接口都能访问在物理媒体上传输的所有数据包。
每个网络接口都有唯一对应的硬件地址—MAC地址，在MAC地址和IP地址之间用ARP和RARP协议进行互相转换。
一般情况，一个网络接口指响应两种数据：与自己硬件地址相匹配的数据帧和广播数据帧；而对于网卡而言通常有四种接受模式：广播方式、组播方式、直接方式和混杂模式。