Research On Computer Forensic For Storage Media

Research regarding computer forensic technology has become more active with the recent increasing in computer crime. Some key questions on building a computer forensic system for storage media have been researched in the thesis. As a result, seven principal achievements have been obtained.Firstly, collected information on the field of computer forensics study includes development status, future development trend and existing tools. Frame of computer forensic system is built.Secondly, based on the above results, a computer forensics system for storage media is established, which includes three main parts, six basic tools.Thridly, disk mirroring tool can generated image files for removable disk, floppy disk, CD-ROM and hard disk by multithreading. Image files can be verified with md5verification algorithms.Fourthly, virtual disk tool can generate virtual disks via mount disk image files and protect data from damage caused by misoperation.Fifthly, data recovery tool can recover deleted files from several storage media such as hard disk, floppy disk, removable disk and other storage devices. Also, it can analyse and recover files in NTFS and FAT file system with a higher success rate.Sixthly, encryption discover tool can conveniently and quickly detect encryption files in storage media and scanning engine can easily extend with new type encryption file format.Seventhly, evidence search engine can perform full-text search with common file format, including office document, kingsoft WPS files, adobe pdf, windows txt, html file, eml file. It outputs result as html or txt file format.In summary, the principal achievements of the thesis are helpful to the exploration of computer forensic methods and to the construction of computer forensic system.