Computer Forensics Technical Research Based On The Network

The development and wide spreading of technology of the modern computer and Internet brings great convenience to our daily life, but on the other hand, it also provides a covert for some criminals. The Internet has penetrated deeply into every aspect of our life, it has become a daunting problem for both the government institutions and network administrators that how to acquire valid proofs of the computer crimes and present them to the cour, so as to fight against the computer criminals. Not noly does it require them to invent a practical and effective software for obtaining evidences but also to study the concepts, characteristics, standards, models and electronic security theories, etc.In current thesis, the author had made a comparison and analysis of the characters of quiescent, dynamic and initiative evidence obtainment by using computer and concluded their main characters. On this basis, the author raised a tracing back model of computer evident obtainment, which combined the ways of dynamic and initiative computer evidence obtainment in order to shield the confidential data of banks and the important government institutions. It can initiatively obtain directed evidence of the criminals, and it also protects privacy, to some extent, and avoids abusing the initiative evidence obtainment.At the same time, the current study is directing to electronic evidences'feature of easy correction and easy deletion, as a result, they are hard to preserve.t So based on the initiative evidence obtainment, and aimed at guarding against denying and at keeping conformity of the information, the current study proposed a program against falsifying or denying the electronic evidences by applying the system of ECDSA and taking the ID number of the hard disk as the unique mark for the host.The proposal has the advantage of protecting data, and it is effective to keep the convictors from denying his criminal.