计算机便携式取证系统的设计与实现

摘要

目前，以计算机信息系统为犯罪对象和工具的新型犯罪活动越来越多，造成的危害也越来越大。侦破这些案件必须要用到计算机取证技术，而电子证据本身和取证过程有许多不同于传统物证和取证的特点，给司法工作和信息安全领域都提出了新的挑战。为此，文章设计开发了一款基于Windows PE系统的便捷、实用、安全、有效的计算机便携式取证系统。电子证据的收集与处理是通过内置于U盘的Windows PE系统来完成的；利用OpenSSL提供的编程接口和PKI相关技术实现对电子证据的保密、认证与保存等功能。最后通过测试与分析，表明该系统能实现对电子证据的收集、处理和电子证据的安全有效保存。%　　At present, with the increasing number of new criminal activities, the harm is also growing in the computer information systems. The detection of these cases have to use computer forensics, the electronic evidence and the processes of evidence collecting have many characteristics different from traditional physical evidence, which have raised new challenges to the administration of justice and information security. Therefore, we designed and developed a convenient, practical, safe, effective system of portable computer forensics based on Windows PE System. The collection and processing of electronic evidence is to complete through the U disk being built into the Windows PE;by use of programming interface provided by the Open SSL and PKI technology, we realize the encryption, authentication and storage of electronic evidence. Finally, the results of test and analysis showed that this system can achieve the collection, processing, safe&effective storage of electronic evidence.