计算机取证分析2

计算机取证技术实验报告一、实验目的二、实验原理1.计算机文件的删除计算机文件的删除并不是真正的删除，而是将文件的存储空间标记为可重用状态。

通过合适的方法可以恢复已删除的文件。

2.隐藏文件计算机中的文件可以通过更改文件的属性来隐藏。

隐藏文件需要特殊的手段进行查找和恢复。

3.数据流计算机中的数据都是以数据流的形式存储的，可以通过分析数据流来获取有用的信息和证据。

4.元数据元数据是指记录文件属性和存储位置的数据，包括文件的创建时间、修改时间等信息。

通过分析元数据可以还原文件的使用轨迹。

三、实验步骤1.文件删除恢复实验首先，在计算机上创建一个包含敏感信息的文件，然后将其删除到回收站。

接下来，使用特定的恢复软件对回收站进行扫描，找回已删除的文件。

最后，验证恢复的文件是否包含原始的敏感信息。

2.隐藏文件实验在计算机上创建一个需要隐藏的文件，并将其属性设置为隐藏。

然后，通过查找隐藏文件的方法来寻找被隐藏的文件。

验证查找结果是否正确。

3.数据流分析实验在计算机上创建一个包含敏感信息的文件，并将其复制到不同的位置。

通过分析数据流，找到敏感文件的所有副本。

验证数据流分析的准确性。

4.元数据分析实验在计算机上创建一个包含敏感信息的文件，并对其进行不同的操作，如复制、重命名等。

通过分析文件的元数据，还原文件的使用过程。

验证元数据分析的有效性。

四、实验结果与分析本实验中，通过对文件删除恢复、隐藏文件、数据流分析和元数据分析的实验，成功地获取了敏感信息和相关证据。

实验结果表明，计算机取证技术是一种高效、可靠的方法，对于犯罪活动的调查和审判具有重要的意义。

五、实验总结本实验通过对计算机取证技术的实践，加深了对计算机取证技术原理和方法的理解和掌握。

计算机取证技术在现代社会中具有重要的应用价值，对于维护社会安全和网络安全起到了重要的作用。

通过本次实验，我对计算机取证技术有了更深入的了解，并对其在实际工作中的应用有了更清晰的认识。

计算机取证分析内部编号：（YUUT-TBBY-MMUT-URRUY-UOOY-DBUYI-0128）摘要信息技术的不断发展给人们的生活带来了巨大的改变，网络已经越来越渗透到人们的现实生活与工作当中。

然而，网络在为人民生活和工作带来便利的同时，也引发了无数网络犯罪。

计算机静态取证便是针对网络犯罪而出现的一种电子取证技术，而随着网络犯罪形式和手段的千变万化，计算机静态取证已不能满足打击网络犯罪的需求，为适应信息化发展的要求，建立安全网络环境和严厉打击网络犯罪行为势在必行，本论文针对计算机动态取证技术进行分析，主要浅谈电子动态取证采集系统的实现、网络证据收集和网络数据分析等几个方面。

通过对计算机取证基本概念、特点和技术的基础研究，对计算机动态取证进行分析。

关键词：电子取证动态取证动态电子证据采集网络数据协议目录一、概述（一）、研究背景目前，人类社会已经迈入了网络时代，计算机与互联网已经与老百姓的日常工作、学习与工作息息相关，社会信息化对政治、经济、文化和科技等各项社会生活产生了深远的影响。

然而，网络技术给人类社会带来有利影响的同时，也带来了负面的影响。

在国外，1988年11月美国国防部的军用九三级网络遭受莫里斯病毒袭击，致使美国Internet网络上6000多台计算机感染，直接经济损失9600万美元。

2000年5月，“爱虫”病毒通过电子邮件传播，在世界各地迅速蔓延，造成全世界空前的计算机系统破坏。

而在国内，人们利用计算机网络犯罪的案例也层出不穷。

2002年，作案人吕薜文通过盗用他人账号，对中国公众多媒体通信网广州主机进行了攻击，并对其部分文件进行删除、修改、增加等一系列非法操作，造成严重后果。

2008年4月，作案人赵哲窜至上海某证券攻击营业部，利用该营业部电脑安全防范上的漏洞，修改该营业部部分股票交易数据，致使股价短时间内剧烈震荡。

计算机以及其他信息设备越来越多的被运用到犯罪活动中，尽管随着入侵检测系统的广泛使用降低了非法使用计算机资源所带来的损失，但网络犯罪依然不可忽视。

2计算机犯罪与取证计算机犯罪是指利用计算机技术、网络和互联网进行的非法活动。

这些非法活动包括网络欺诈、黑客攻击、网络间谍、电子数据篡改以及色情、赌博等违法行为。

在信息时代，计算机犯罪的手段日益多样化、隐蔽化，犯罪分子可以通过计算机渗透他人网络、窃取个人隐私、盗取财产，甚至造成对国家机密情报的泄露。

计算机犯罪的黑暗势力正不断挑战法律、技术和社会的底线。

计算机犯罪不仅给个人和社会造成了巨大的经济损失，还给社会进行计算机犯罪的调查和打击提出了巨大的挑战。

这就需要计算机取证这一技术手段的运用。

计算机取证是一门取证学科，通过对计算机的取证和分析，来揭示犯罪的事实和犯罪的产生过程。

计算机取证的流程主要包括收集证据、保存证据、分析证据和呈现证据。

首先，要收集证据。

这包括收集与计算机犯罪相关的数据和信息。

然后，收集到的证据需要被保存起来，以确保证据的完整性和可靠性。

这一步骤非常重要，因为计算机犯罪的证据一旦丢失或损坏，将对取证工作产生不可估量的影响。

接下来，对证据进行分析。

这意味着对证据进行提取、比对、恢复和解读，以获取证据中蕴含的意义和信息。

最后，将分析的结果呈现给相关的调查人员、法庭或其他需要使用这些证据的人员。

计算机取证的过程并不容易。

首先，计算机犯罪的手段和方式非常多样化、复杂化。

这就要求取证人员具备一定的专业知识和技能，能够熟练操作各种取证工具和技术。

其次，随着科技的不断发展，计算机犯罪的手段也在不断更新。

这就要求取证人员不断学习和更新自己的知识，跟上技术的变化。

再者，计算机犯罪往往跨越国界，这意味着取证人员可能需要与其他国家的执法机构合作，需要进行跨国调查和取证。

最后，取证工作需要保护证据的完整性和可靠性，以避免证据被篡改或意外丢失。

因此，取证人员必须严格遵守法律、规章和道德准则，确保取证工作的准确性和合法性。

在计算机犯罪与取证的斗争中，法律和技术是两个不可或缺的因素。

法律的制定和实施为打击计算机犯罪提供了重要的法律依据和保障。

计算机取证技术1 计算机取证概述针对计算机取证技术的特殊性，在后续利用阶段要对技术类型进行分析，按照取证流程进行。

所谓的计算机取证指的是对计算机入侵、破坏或者攻击等犯罪行为采用有效的硬软件技术进行分析，考虑到国家相关法律政策以及规范系统的具体要求，要取证阶段，要对其进行分析和保存。

从技术角度而言，计算机取证能对入侵计算机系统进行破解和扫描，考虑到系统重建模式的属性变化，在利用和设计过程中要及时对信息指标进行分析。

在取证阶段分为不同的阶段，其一是获取数据、发现信息，此外在获取数据的阶段要对入侵现象进行评价，按照计算机硬件系统指标要求落实。

其次是对信息进行分析，也就是取证调查，包括现场勘查、数据分析和证据分析等方面。

由于不同的步骤都有自己的特点，因此需要结合数据结果和犯罪事实数据形式要求，对案件进行取证分析。

2 计算机取证技术分析考虑到计算机取证技术形式的特殊要求，在数据分析阶段，可以从不同角度入手，做好数据分析工作。

随着计算机技术的不断推广和发展，取证技术种类增加，应用优势显著。

以下将对计算机取证技术进行分析。

2.1 蜜罐网络取证技术蜜罐网络取证技术的应用优势显著，近些年来得到了广泛的推广。

通过安全网的有效布置和操控，能及时对各类信息进行总结和比较。

主动蜜罐系统成为关键所在，该系统形式可以自动生成一个匹配对象，系统本身可以实现自动化处理，对各类信息进行比较。

此外蜜罐网系统中中的蜜罐都是虚拟的，其本身配备合法的外部ID，能对独立的机器进行处理。

此外考虑到操作系统的属性变化，在系统模仿分析阶段，要独立收集数据，实现日志和蜜罐的分离操作。

通过蜜罐系统可以对攻击者在蜜罐的时间进行掌握，获取针对性的信息，此外考虑到防范措施系统的具体要求，为了提升系统的安全性，需要对技术属性进行分析，满足取证技术的具体要求。

2.2 数字图像过滤技术所谓的数字图像过滤技术指的是对图像篡改或者图像不真实的现象进行处理，最重要的是对图像合成进行检测。

摘要计算机取证及数据恢复技术包括两个部分，即计算机取证和数据恢复。

电子证据既有法律方面的问题，也有技术方面的问题，本文就其子集“计算机取证”的技术体系进行研究和分析，指出了计算机取证的技术体系及其层次关系，为深入研究计算机取证提供了一个借鉴。

社会信息化的发展给我们生活带来诸多便捷的同时，也给信息罪犯带来可乘之机。

病毒、黑客、网络攻击的日益泛滥，计算机犯罪案件数量不断上升，搜集电子证据就成为提供重要线索及破案的关键。

计算机取证是使用软件和工具提取和保护有关计算机犯罪的证据。

数据恢复技术，是一门新兴的边缘学科，是技术性与实践性相结合的新技术，需要非常深厚的技术功底和实践经验，绝不是一种简单的流水线作业似的操作。

数据恢复技术目的在于让人们学到如何把硬盘上被破坏的数据抢救回来、以及如何保护硬盘中的重要数据的方法。

它同时要求人们通过各种手段来把丢失和遭到破坏的数据还原为正常的数据。

本文主要研究了计算机取证技术及数据恢复的基本原理，并通过一个具体实例演示了数据恢复的过程。

关键词：计算机取证: 计算机取证技术恢复技术目录第一章绪论 (1)1.1计算机取证总论 (1)1.1.1病毒的威胁 (1)1.1.2计算机取证技术的高科技性 (1)1.1.3计算机取证的发展 (1)1.2数据恢复总论 (2)1.2.1数据恢复的定义 (2)1.2.2数据恢复的服务范围 (2)1.2.3数据恢复的一般原则 (3)第二章计算机取证技术研究概述 (4)2.1计算机取证的基本概念 (4)2.1.1计算机取证服务 (4)2.1.2计算机取证的原则和步骤 (4)2.2计算机取证技术的发展 (5)2.2.1计算机取证遇到的问题 (5)2.2.2计算机取证的工具 (5)2.2.3电子证据基本内容机及获取 (6)第三章数据恢复基本原理 (8)3.1硬盘的工作原理 (8)3.1.1 硬盘的分区 (8)3.1.2 硬盘分区方式 (9)3.2数据存储原理 (9)第四章数据恢复实例 (12)4.1恢复软件的下载及安装 (12)4.2数据恢复软件的运行过程 (12)4.3数据恢复操作 (15)4.3.1快速文件搜索 (15)4.3.2完整文件搜索 (18)4.3.3快速格式化恢复 (18)4.3.4完全格式化恢复 (19)4.3.5保存为CD/VCD方式 (20)第五章总结语 (21)致谢 (22)参考文献 (22)第一章绪论1.1计算机取证总论1.1.1病毒的威胁随着计算机入侵和病毒的泛滥，信息安全需深入人心。

计算机取证与分析步骤1、关闭计算机2、记录（拍照）嫌疑计算机硬件配置与状态3、将嫌疑计算机转移至安全地点4、对硬盘或软盘做位对位获取5、对存储介质中的数据做验证6、记录系统日期和时间7、确定关键字符清单8、分析Windows Swap交换文件9、分析文件残留区File Slack10、分析未分配空间11、在文件、文件残留区、未分配空间中搜索关键字符12、记录文件名、日期、时间13、Computer Evidence Processing StepsNTI conducts hands-on computer forensics training courses which expose computer professionals to the many hazzards and risks associated with computer evidence processing and computer security. NTI's computer forensics training courses designed to drive home several important points, i.e., computer evidence is fragile by its very nature and the problem is compounded by the potential for destructive programs and hidden data.Even the normal operation of the computer can destroy computer evidence that might be lurking in temporary operating system files, temporary application working files and ambient data storage areas. NTI provides its training clients with a solid foundation built upon technical knowledge so that they will understand the technical issues concerning the creation, modification and storage of computer data. Without this knowledge they will be unable to testify about their computer forensic findings. NTI also wants its clients to have a complete understanding of the technical issues so that they can make the right decisions about computer security risk management and computer evidence processing issues. It is not enough to run a computer forensics program and get results. Good decisions are made by knowledgable individuals who understand the underlying tec hnical issues tied to the potential security risks and evidence processing issues tied to personal computers.There are no strict rules that must be followed concerning the processing of computer evidence. Every case is different and flexibility and good technical knowledge make the difference between success and failure. However, many times decisions need to be made without full the knowledge of the issues involved. For that reason NTI has provided the following guidelines which are intended to assist its clients. Please remember that these guidelines do not represent 'the only true way'. They are intended to be general guidelines which are provided as food for thought. If you have an emergency and you are not yet formally trained, click here for emergency guidelines.General evidence processing guidelines follow:1. Shut Down the ComputerDepending upon the computer operating system involved, this usually involves pulling the plug or shutting down a net work computer using relevant operating system commands. At the option of the computer specialists, pictures of the screen image can be taken using a camera. However, consideration should be given to possible destructive processes that may be operating in the background. These can be resident in memory or available through a modem or network connection. Depending upon the operating system involved, a time delayed password protected screen saver may potentially kick in at any moment. This can complicate the shutdown of the computer. Generally, time is of the essence and the computer system should be shut down or powered down as quickly as possible.2. Document the Hardware Configuration of The SystemIt is assumed that the computer system will be moved to a secure location where a proper chain of custody can be maintained and the processing of evidence can begin. Before dismantling the computer, it is important that pictures are taken of the computer from all angles to document the system hardware components and how they are connected. Labeling each wire is also important so that the original computer configuration can be restored. Computer evidence should ideally be processed in a computer hardware environment that is identical to the original hardware configuration.3. Transport the Computer System to A Secure LocationThis may seem basic but all too often seized evidence computers are stored in less than secure locations. It is imperative that the subject computer is treated as evidence and it should be stored out of reach of curious computer users. All too often, individuals operate seized computers without knowing that they are destroying potential computer evidence and the chain of custody. Furthermore, a seized computer left unintended can easily be compromised. Evidence can be planted on it and crucial evidence can be intentionally destroyed. A lack of a proper chain of custody can 'make the day' for a savvy defense attorney. Lacking a proper chain of custody, how can you say that relevant evidence was not planted on the computer after the seizure? The answer is that you cannot. Do not leave the computer unattended unless it is locked in a secure location! NTI provides a program named Seized to law enforcement computer specialists free of charge. It is also made available to NTI's business and government in various suites of software that are available for purchase. The program is simple but very effective in locking the seized computer and warning the computer operator that the computer contains evidence and should not be operated. Click here for information about NTI's software suites or click here for the law enforcement order form.4. Make Bit Stream Backups of Hard Disks and Floppy DisksThe computer should not be operated and computer evidence should not be processed until bit stream backups have been made of all hard disk drives and floppy disks. All evidence processingshould be done on a restored copy of the bit stream backup rather than on the original computer. The original evidence should be left untouched unless compelling circumstances exist. Preservation of computer evidence is vitally important. It is fragile and can easily be altered or destroyed. Often such alteration or destruction of data is irreversible. Bit stream backups are much like an insurance policy and they are essential for any serious computer evidence processing. More information about bit stream backups has been provided on this site. Click here for the article about making bit stream backups. In March 2000, NTI purchased SafeBack software from Sydex, Inc. This is a very popular bit stream backup tool that has become an international standard since 1991. NTI covers the use of this software in its computer forensics training courses.5. Mathematically Authenticate Data on All Storage DevicesY ou want to be able to prove that you did not alter any of the evidence after the computer came into your possession. Such proof will help you rebut allegations that you changed or altered the original evidence. Since 1989, law enforcement and military agencies have used a 32 bit mathematical process to do the authentication process. Mathematically, a 32 bit data validation is accurate to approximately one in 4.3 billion. However, given the speed of today's computers and the vast amount of storage capacity on today's computer hard disk drives, this level of accuracy is no longer accurate enough. A 32 bit CRC can easily be compromised. Therefore, NTI includes two programs in its forensic suites of tools that mathematically authenticate data with a high level of accuracy. Large hashing number, provides a mathematical level of accuracy that is beyond question. These programs are used to authenticate data at both a physical level and a logical level. The programs are called CrcMD5 and DiskSig Pro. The latter program was specifically designed to validate a restored bit stream backup and it is made available free of charge to law enforcement computer specialists as part of NTI's Free Law Enforcement Suite. The programs are also included in our various suites of forensic software which are sold NTI's clients.6. Document the System Date and TimeThe dates and times associated with computer files can be extremely important from an evidence standpoint. However, the accuracy of the dates and times is just as important. If the system clock is one hour slow because of daylight-saving time, then file time stamps will also reflect the wrong time. To adjust for these inaccuracies, documenting the system date and time settings at the time the computer is taken into evidence is essential. NTI has created a program called GetTime which is used for this purpose. It is included in the NTI various suite of tools.7. Make a List of Key Search WordsBecause modern hard disk drives are so voluminous, it is all but impossible for a computer specialist to manually view and evaluate every file on a computer hard disk drive. Therefore, state-of-the-art automated forensic text search tools are needed to help find the relevant evidence. One such tool is NTI's TextSearch NT which is certified for use by the U. S. Department of Defense. Usually, some information is known about the allegations in the case, the computer user and the alleged associates that may be involved. Gathering information from individuals familiar with the case to help compile a list of relevant key words is important. Such key words can be used in the search all computer hard disk drives and floppy diskettes using automated software. Keeping the list as short as possible is important and you should avoid using common words orwords that make up part of other words. In such cases, the words should be surrounded with spaces. Intelligent filtering tools can also be helpful in crafting lists of key words for use in computer evidence processing, e.g., NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML.8. Evaluate the Windows Swap FileThe Windows swap file is potentially a valuable source of evidence and leads. The evaluation of the swap file can be automated with several of NTI's forensic tools, e.g., NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML. These intelligent filters automatically identifies patterns of English language text, phone numbers, social security numbers, credit card numbers, Internet E-Mail addresses, Internet web addresses and names of people.In the past this tedious task of analyzing Windows swap files was done with hex editors and the process took days to evaluate just one Windows swap file. By using automated tools, that process now takes just a few minutes. When Windows 95/98 is involved, the swap file may be set to be dynamically created as the computer is operated. This is the default setting and when the computer is turned off, the swap file is erased. However, not all is lost because the content of the swap file can easily be captured and evaluated by NTI's GetFree program. This program automatically captures erased file space and creates a file that can be evaluated by NTI's various intelligent filter programs mentioned above.The NTA Stealth program relies upon artificial intelligence fuzzy logic to identify patterns of text associated with past Internet activities. This program is used by probation and parole officers to montior the computer and Internet activity of convicted sex offenders. It is also used in corporations to identify inappropriate uses of computers in the workplace and it is used in law enforcement and military agencies.The output from NTA Stealth, Filter_N, FNames, Filter_G, GExtract and GetHTML. can be successfully used to identify 'unknown key words' that can supplement the key word list created in the step above. The automated review of the Windows swap file takes just a few minutes with these automated tools. A manual review of the Windows swap file can take days or even weeks if the process is done manually using programs like the Norton utilities.9. Evaluate File SlackFile slack is a data storage area of which most computer users are unaware. It is a source of significant 'security leakage' and consists of raw memory dumps that occur during the work session as files are closed. The data dumped from memory ends up being stored at the end of allocated files, beyond the reach or the view of the computer user. Specialized forensic tools are required to view and evaluate file slack and it can prove to provide a wealth of information and investigative leads. Like the Windows swap file, this source of ambient data can help provide relevant key words and leads that may have previously been unknown.On a well used hard disk drive, as much as 900 million bytes of storage space may be occupied by file slack. File slack should be evaluated for relevant key words to supplement the keywords identified in the steps above. Such keywords should be added to the computer investigator's list ofkey words for use later. Because of the nature of file slack, specialized and automated forensic tools are required for evaluation. NTI has created a forensic utility called GetSlack that captures file slack from hard disk drives and floppy disks. The output from the GetSlack program can be evaluated in the same fashion as a Windows swap file using the intelligent filter programs listed above. File slack is typically a good source of Internet leads.10. Evaluate Unallocated Space (Erased Files)The DOS and Windows 'delete' function does not completely erase file names or file content. Many computer users are unaware the storage space associated with such files merely becomes unallocated and available to be overwritten with new files. Unallocated space is a source of significant 'security leakage' and it potentially contains erased files and file slack associated with the erased files. Often the DOS Undelete program can be used to restore the previously erased files. Like the Windows swap file and file slack, this source of ambient data can help provide relevant key words and leads that may have previously been unknown to the computer investigator. On a well used hard disk drive, millions of bytes of storage space may contain data associated with previously erased files. Unallocated space should be evaluated for relevant key words to supplement the keywords identified in the steps above. Such keywords should be added to the computer investigator's list of key words for use in the next processing step. Because of the nature of data contained in unallocated space and its volume, specialized and automated forensic tools are required for evaluation. NTI has created a forensic utility called GetFree that quickly captures all unallocated space from hard disk drives and floppy disks. The output from the GetFree program can be evaluated in the same fashion as the other types of ambient data mentioned previously using intelligent filter programs. Unallocated space is typically a good source of data that was previously associated with word processing temporary files and other temporary files created by various computer applications. It is also a good source of leads concerning graphics files that have been viewed over the Internet and NTI's GExtract software can be used very effectively to identify these graphic file remnants left behind in unallocated storage space.11. Search Files, File Slack and Unallocated Space for Key WordsThe list of relevant key words identified in the previous steps should be used to search all relevant computer hard disk drives and floppy diskettes. There are several forensic text search utilities available in the marketplace. NTI's forensic search TextSearch NT can be used for that purpose and it has been tested and certified for accuracy by the U. S. Department of Defense. This powerful search tool is also included as part of NTI's suites of software tools. It was designed to be a state-of-the-art search tool for use as a security review tool by U. S. government intelligence agencies. This program and other NTI forensic tools also provide significant benefits in cases involving computer related evidence. For this reason and to help stretch limited law enforcement budgets, NTI makes all of its forensic software tools and training available to law enforcement computer crime specialists for discounted prices.It is important to review the output of a forensic text search utility. When relevant evidence or leads are identified, the fact should be noted and the identified data should be documented. When new key words are identified in the searching process, then they should be added to the list and anew search should be conducted using the text search utility again with the updated search list. Text search utilities are also used, on a regular basis, in classified government agencies for security reviews. When evidence or unexpected findings are uncovered in government security reviews, they should also be documented and archived as potential evidence. NTI's TextSearch NT is certified by the U. S. Department of Defense and its little brother, TextSearch Plus has been used for years in classified U. S. government agencies to process evidence and to conduct computer security reviews.12. Document File Names, Dates and TimesFrom an evidence standpoint, file names, creation dates, last modified dates and times can be relevant. Therefore, it is important to catalog all allocated and 'erased' files. NTI includes a program called FileList Pro in its various suites of forensic tools. The FileList Pro program generates its output in the form of a database file. The file can be sorted based on the file name, file size, file content, creation date, last modified date and time. Such sorted information can provide a timeline of computer usage. When FileList Pro created databases can be combined from several computers in the same case and the sorted output can provide conspiratorial leads for further investigation. This powerful inventory tool is used to evaluate all Microsoft-based computer systems in computer related investigations.NTI also created another forensic documentation tool called NTIDOC. This program is used to take electronic snapshots of relevant computer files. The program automatically records the file name, time and date along with relevant file attributes. The output is in the form of a word processing compatible file that can be used to help document computer evidence issues tied to specific files.13. Identify File, Program and Storage AnomaliesEncrypted, compressed and graphic files store data in binary format. As a result, text data stored in these file formats cannot be identified by a text search program. Manual evaluation of these files is required and in the case of encrypted files, much work may be involved. NTI's TextSearch Plus program has built in features that automatically identify the most common compressed and graphic file formats. The use of this feature will help identify files that require detailed manual evaluation. Depending on the type of file involved, the contents should be viewed and evaluated for its potential as evidence.Reviewing the partitioning on seized hard disk drives is also important. The potential exists for hidden partitions and/or partitions formatted with other than a DOS compatible operating system. When this situation exists it is comparable to finding a hidden hard disk drive and volumes of data and potential evidence can be involved. The partitioning can be checked with any number of utilities including the DOS FDISK program or Partition Magic. When hidden partitions are found, they should be evaluated for evidence and their existence should be documented.If Windows is involved, it makes sense to evaluate the files contained in the Recycle Bin. The Recycle Bin is the repository of files selected for deletion by the computer user. The fac t that they have been selected for deletion may have some relevance from an evidentiary standpoint. Ifrelevant files are found, the issues involved should be documented throughly.14. Evaluate Program FunctionalityDepending on the application software involved, running programs to learn their purpose may be necessary. NTI's training courses make this point by exposing the students to computer applications that do more than the anticipated task. When destructive processes are discovered that are tied to relevant evidence, this can be used to prove willfulness. Such destructive processes can be tied to 'hot keys' or the execution of common operating commands tied to the operating system or applications. Before and after comparisons can be made using the FileList Pro program and/or mathematical authentication programs. All these tools are included in most of NTI's suites of forensic tools15. Document Y our FindingsAs indicated in the preceding steps, it is important to document your findings as issues are identified and as evidence is found. Documenting all of the software used in your forensic evaluation of the evidence including the version numbers of the programs used is also important. Be sure that you are legally licensed to use the forensic software. Software pirates do not stand up well under the riggers of a trial. Smart defense lawyers will usually question software licensing and you don't want to testify that you used unlicensed software in the processing of computer evidence. Technically, software piracy is a criminal violation of federal copyright laws.When appropriate, mention in your documentation that you are licensed to use the forensic software involved. With NTI's software, a trail of documentation is automatically created for the computer investigator and the name of the licensed user is listed in most output files. This feature aids in establishing who did the processing and the exact time and date when the processing was done. Screen prints of the operating software also help document the version of the software and how it was used to find and/or process the evidence.16. Retain Copies of Software UsedAs part of your documentation process, we recommend that a copy of the software used be included with the output of the forensic tool involved. Normally this is done on an archive Zip disk, Jazz disk or other external storage device, e.g. external hard disk drive. When this documentation methodology is followed, it eliminates confusion at trial time about which version of the software was used to create the output. Often it is necessary to duplicate forensic processing results during or before trial. Duplication of results can be difficult or impossible to achieve, if the software has been upgraded and the original version used was not retained. Please note that there is a high probability that you will encounter this problem because most commercial software is upgraded routinely but it may take years for a case to go to trial.。

计算机取证技术简析计算机取证是指能够为法庭接受的、足够可靠和有说服力的、存在于计算机和相关外设中的电子证据的确定、收集、保护、分析、归档以及法庭出示的过程。

计算机取证基本围绕电子证据展开。

电子证据是指在计算机或计算机系统运行过程中产生的，以其记录的内容来证明案件事实的电磁记录物。

电子证据的表现形式是多样的，尤其是多媒体技术的出现，使电子证据综合了文本、图形、图像、动画、音频及视频等多种媒体信息，这种以多媒体形式存在的计算机证据几乎涵盖了所有传统证据类型。

与传统证据一样，电子证据必须是可信的、准确的、完整的、符合法律法规的。

与传统证据相比较，电子证据还具有以下特点：1）脆弱性：由于数据自身的特点导致电子证据易被修改，且不易留痕迹；2）无形性：计算机数据必须借助于输出设备才能呈现结果；3）高科技性：证据的产生、传输、保存都要借助高科技含量的技术与设备；4）人机交互性：电子证据的形成，在不同的环节上有不同的操作人员参与，它们在不同程度上都可能影响电子证据的最终结果；5）电子证据是由计算机和电信技术引起的，由于其它技术的不断发展，所以取证步骤和程序必须不断调整以适应技术的进步。

电子证据的来源很多，主要有系统日志、IDS、防火墙、FTP、反病毒软件日志、系统的审计记录、网络监控流量、电子邮箱、操作系统和数据库的临时文件或隐藏文件，数据库的操作记录，硬盘驱动的交换（Swap）分区、实时聊天记录等等。

电子证据的获取方法包括数字鉴定、数据检查、数据对比、数据保护、数据分析和证据抽取。

而这些方法的实施将贯穿整个计算机取证过程。

由于自身的局限性和计算机犯罪手段的变化，特别是反取证软件的出现，现有的取证技术已经不能满足打击犯罪的要求。

随着取证领域的扩大，取证工具将向着专业化和自动化方向发展，并在无线环境下得到进一步应用，如手机、PDA、传真等无线终端设备的取证。

所以，还需要加深对计算机取证方面的知识以及计算机应用才能更有效的实现计算机取证。