基于Windows 平台的动态取证系统

针对目前一些动态取证模型的不足,在分布式网络取证模型的基础上设计了一个基于Windows平台的动态取证系统,能够实现网络中的计算机作为作案目标和作案工具双重角色时的取证,具有实时获取多种数据源、取证过程隐秘、取证分析算法可扩展等特点。介绍了动态取证系统中各功能模块设计,并阐述了系统设计中涉及到的关键技术,最后通过模拟测试表明该系统能够在Windows网络下实现动态取证。

Dynamic Forensics System Based on Windows Platform

In view of the shortages of some dynamic forensics model at present,this paper designs a dynamic forensics system in distributed network forensics model based on Windows platform,which can realize obtaining evidence on the computers that plays a dual role on the network as crime goals and crime tools,and have the characteristic of real-time accessing various data sources,forensics process secretive,forensic analysis algorithm extensible etc.This paper introduces the designing of each function module in the dynamic forensics system at first.Second,it lays out the key technology that appears in the design process of the system.Finally,simulation test indicates that the system can realize dynamic forensics in Windows network.