Research And Virtual Simulation On Computer Forensic Disk Image

With the rapid development of computer and network technology, individuals become more and more dependent on computers. However, cyber crimes also become more and more frequent. As a cross-disciplinary of the computer, criminal investigation and law, computer forensic technology plays an increasingly important role in fighting against cyber criminals and maintaining social stability.The development of computer hardware leads the computer a high computation performance, but it also results in a lot of resource waste. So how to make full use these resources and improve the hardware resources become the urgent provlems to be solved in the computer field. According to this situation, virtualization technology is one of the means to solve these problems. More importantly, it brings a new opportunity for computer forensics, and this can be a major trend to computer forensics.This thesis is focused on computer forensics disk image and virtualization technology. The details are as follows:1. This thesis researches and summarizes the common format of the existing computer forensics disk images and the mainstream E01 disk image file format, and analyzes on the orign, format of E01 image file and image access respectively.2. The key technology to virtualization technology is the dynamic start in image file system. This thesis mainly analyzes it in detail from the image transformation and master boot recorder, and provides the dynamic start process of the image file system.3. Aim at the password bypass technology in the process of virtual simulation, this thesis analyzes the login authentication of system password of Windows, Linux and Mac OS X from user password encryption mechanism, storage location and password bypass respectively.In general, this thesis implements the E01 disk image access, dynamic simulation and password bypass to Windows, Linux and Mac OS X on Windows platform.