一种基于闪存物理镜像的FAT文件系统重组方法

文件系统重组是闪存设备取证研究进行数据恢复的主要手段.传统的文件系统重组方法需要同时获取闪存设备在同一时刻的逻辑镜像和物理镜像,该条件在取证实践中常常难以满足,故提出一种仅依赖闪存物理镜像重组文件分配表(FAT)文件系统的方法.在引入统计分析法从物理镜像中提取逻辑地址字段和页状态字段的基础上,给出利用最新页状态值准确重组闪存设备最新FAT文件系统镜像的算法.最后以MTK6229闪存设备物理镜像的FAT文件系统重组过程为例,验证上述重组算法及相关方法是正确的.     

深度文件取证系统的设计与实现

随着计算机犯罪事件的不断增加,计算机取证技术越来越受到人们的重视。文章分析和讨论了计算机取证技术,总结了计算机取证的一般流程和取证原则,在此基础上提出和分析了深入信息提取,并给出了深度文件取证系统的设计和实现。主要包括两个方面的内容：一是研究了办公文件的数据组织结构,设计出了元数据信息的提取方案;二是研究被删除文件的磁盘存储结构,利用磁盘上残留的文件信息恢复出被删除的文件,从而为司法鉴定取得有用信息。     

图像序列的视频流开发及网络发送的实现

Raw文件是一种原始图像,对其序列文件视频流的开发是获取图像信息的重要手段.利用DirectShow技术开发出源过滤器和发送过滤器,实现了Raw序列文件的读取和发送.文件映射和中间缓存技术的应用提高了文件读取和视频流的传输效率.     

Windows Vista操作系统下网络状态信息的获取方法

A method to extract information of network connection status information from physical memory on Windows Vista operating system is proposed. Using this method, a forensic examiner can extract accurately the information of current TCP/IP network connection information, including IDs of processes which established connections, establishing time, local address, local port, remote address, remote port, etc., from a physical memory on Windows Vista operating system. This method is reliable and efficient. It is verified on Windows Vista, Windows Vista SP1, Windows Vista SP2.     

Merging VLIW and vector processing techniques for a simple,high-performance processor architecture

This paper proposes a new processor architecture called VVSHP for accelerating data-parallel applications, which are growing in importance and demanding increased performance from hardware. VVSHP merges VLIW and vector processing techniques for a simple, high-performance processor architecture. One key point of VVSHP is the execution of multiple scalar instructions within VLIW and vector instructions on unified parallel execution datapaths. Another key point is to reduce the complexity of VVSHP by designing a two-part register file: (1) shared scalar–vector part with eight-read/four-write ports 64×32-bit registers (64 scalar or 16×4 vector registers) for storing scalar/vector data and (2) vector part with two-read/one-write ports 48 vector-registers, each stores 4×32-bit vector data. Moreover, processing vector data with lengths varying from 1 to 256 represents a key point for reducing the loop overheads. VVSHP can issue up to four scalar/vector operations in each cycle for parallel processing a set of operands and producing up to four results to be written back into VVSHP register file. However, it cannot issue more than one memory operation at a time, which loads/stores 128-bit scalar/vector data from/to data memory. The design of our proposed VVSHP processor is implemented using VHDL targeting the Xilinx FPGA Virtex-5 and its performance is evaluated.     

Windows系统静态取证技术研究

随着计算机技术的发展和信息化的普及,计算机犯罪事件频繁发生,如何最大限度地获取计算机犯罪相关的电子证据,其中涉及的技术就是计算机取证技术。计算机取证包括对计算机犯罪现场数据的确认、保护、提取、分析。文中对W indows系统被动取证的相关技术进行深入的研究和探讨,在犯罪事件发生后对犯罪行为进行事后的取证,存在着证据的真实性、有效性和及时性问题。计算机取证收集的证据往往是海量的,而且来源复杂,格式不一,文中重点分析了取证过程中如何生成鉴定复件、证据的来源、如何收集分析证据、如何保全证据。     

Optimal Periodic Memory Allocation for Image Processing With Multiple Windows

One major issue in designing image processors is to design a memory system that supports parallel access with a simple interconnection network. This paper presents an efficient memory allocation to minimize the number of memory modules and processing elements with a parallel access capability when multiple windows with arbitrary shapes are specified. This paper also presents an efficient search method based on regularity of window-type image processing. We give some practical examples including a stereo-matching processor for acquiring 3-D information, and an optical-flow processor for motion estimation. These examples show that the numbers of memory modules are reduced to 2.7% and 10%, respectively, in comparison with a basic approach. It is also shown that the search time is less than 1 ms for practical image sizes and window sizes.      

基于IFS的文件访问控制技术研究与应用

信息安全问题随着计算机网络的广泛应用,已经成为一个复杂而严峻的课题。而电子文件的安全是信息安全的核心任务之一,其访问控制在信息安全领域中具有举足轻重的地位。论文在研究IFS（InstallableFileSystem）的基础上,分析比较了NativeAPI拦截技术和文件系统过滤驱动技术,并以示例的形式实现了文件访问控制,为深入研究和应用Windows文件系统过滤驱动技术实施信息安全策略提供了参考。     

TMS320C64x的16-bit Flash加载的可行性分析与实现

简要介绍TMS320C64x系列数字信号处理器(DSP)Flash加载的基本原理,详细论述TMS320C64x DSP与16-bit Flash接口的设计方法及用该方案加载的可行性及优点,给出.out文件到可供软件片上烧写的数据文件的编写方法.     

A 2-/spl mu/m CMOS 8-MIPS digital processor with parallel processing capability

A 2-/spl mu/m CMOS VLSI digital signal processor (DSP) family, the SP50, is described that is capable of eight million instructions per second and up to six concurrent operations in each instruction. Two DSPs, the PCB5010 and PCB5011, have been developed. Both are based on a common architecture which contains two 16-bit data buses, and a 16/spl times/16/spl rarr/40-bit multiplier accumulator and 16-bit ALU, both with multiprecision support in hardware. Also implemented are two static data RAMs (128/spl times/16 or 256/spl times/16), a data ROM (51/spl times/16), a 15-word three-port register file, three address computation units, and five serial and parallel I/O interfaces. The data path is controlled by an orthogonal instruction set, using 40-bit microcode words. The controller contains a five-level stack and an instruction repeat register, and can have either on-chip program memory (RAM: 32/spl times/40; ROM: 987/spl times/40) or off-chip program memory (up to 64K/spl times/40). Benchmarks show a two to sixfold improvement in overall performance over its predecessors.