Research And Application On User Dictionary Data Extraction Of Chinese Input Method Based On CPA

This paper is based on <<IME Forensic system of Shenyang Yongyuan Technology Co., Ltd.>>,discussing the research on data extraction of Chinese IME on chosen plaintext attack.For the operation requirement of Computer Forensic, we apply the technology of Dll management using plugin system, File type indentification and unknown file format analysis, and implement by Visual Studio, and Created a IME user data extraction system based on chosen plaintext attack, to achieve the functions of IME self-learning data extraction, entry and word frequency information can be extracted. The thesis against the problem of E-Discovery of Computer Forensics, introduce the knowledge of Computer Forensics and system development principles, and discussed the Key technologies of IME self-learning data extraction in detail. And implement a IME Forensic system efficiency, show how to analyze the file format. At last, based on the experiment and analysis, and the Results demonstrate the effectiveness.Since computer information security concepts are gradually began to spread in the community, a group of anti-forensics software gradually surfaced, making the valid information in the computer forensics work can be gradually reduced, a sharp increase in the difficulty of the work. Meanwhile, in the case investigation process directly related to the target information, such as name, address, conversation keywords, etc., can be reflected in the IME user data, such information on the detection of cases have a direct role in the promotion. In addition, the IME user data as a trace of information, the information has not yet been as signs of concern, it is not anti-forensics tools are concerned, therefore, using this method can get a lot of direct, effective information from the target computer. In order to better obtain valid information in computer forensics work favorably with the case investigation, the development of Chinese input method user dictionary automatically forensics system has urgent work demands.