基于Windows物理内存取证系统设计与实现

随着信息安全技术的快速发展,数字取证调查技术已经成为重要技术之一。由于物理内存中包含计算机操作的大量信息,针对物理内存的实时取证分析已成为当前数字犯罪调查领域中的热点研究问题之一。文章通过研究物理内存获取技术,内存进程管理模式,信息关键词搜索技术等相关技术背景,实现对Windows物理内存的镜像获取,内存中的隐藏进程和异常进程的检测,内存中敏感信息的检测分析三方面功能。通过对用户主机进行调查检测,掌握用户大量的操作行为和有用信息,为计算机犯罪取证调查和信息安全检查提供了一种很好的方法手段。

Forensic of Physical Memory Windows-based System Design and Implementation

Since the physical memory that contains a wealth of information of computer operations for real-time forensic analysis of physical memory,the current number of criminal investigations has become a hot research field of one of the issues.This access to technology by studying the physical memory,the memory process management model,keyword search technology and other related information technology background,to achieve the mirror of Windows physical memory,hidden processes and abnormal process detection,memory detection and analysis of sensitive information.Investigated by testing the user host,master user behavior and the operation of a large number of useful information for computer forensic investigations and information security protection provides a good means.