面向电子取证的网络多硬盘复制机研究

传统基于硬盘复制机的一对一电子取证模式操作复杂、工作效率较低。为此，设计并实现一种面向电子取证的网络多硬盘复制机。通过iSCSI协议对多个远程硬盘进行数据备份，将数据镜像保存到高容量存储设备中，鉴定终端通过高速存储网络对镜像文件进行数据恢复、鉴定及虚拟分析。实验结果表明，该复制机能够快捷地对多个硬盘进行取证，复制速度约为6.5 GB/min。

Research on Network Multiple Hard Disk Duplicator for Electronic Forensics

Since the usual procedure of electronic forensic based on one-to-one cloning mode is too complicated and lack of efficiency,this paper proposes a network multiple hard disk duplicator for electronic forensics.It uses the iSCSI protocol to backup the data of many remote hard disk,and saves the data image to high capacity torage device.Identification terminal uses high-speed storage network to do data recovery identification and virtual analysis by the image files.Experimental results show that the duplicator has fast and high speed to obtain the evidence,and copy rate is about 6.5 GB/min.