Research On Search And Analysis Of Computer Evidence

Computer Forensics System includes two sections:evidence search and evidence analysis. Main function of the evidence search is collection and position evidence. Main function of the evidence analysis is finishing, analyzing and researching the results of evidence search, so as to determine computer evidence tendency. The title of this thesis is "Research on search and analysis of computer evidence". Here deeply researched the contents of evidence search and evidence analysis. The principal results are as follows:Firstly, research status, algorithm, implementation method of evidence search and evidence analysis are analyzed, which can provide theoretical basis for computer forensics system.Secondly, the core function of keywords search in storage media is determined. System software framework is designed based on MFC Dialog platform. The function that searches the multi-inner-code form of keywords in storage media is implemented by utilizing multithread technology. The key techniques of system software are solved. The system software provides a better tool support for computer forensics.Thirdly, here uses the concept of sense group and Naive Bayesian Algorithm to study sense group-based computer evidence tendency. A feasible method is provided for evidence analysis of computer forensics system.Finally, the results show that:the system software that searches keywords in storage media and the method of sense group-based computer evidence tendency have reasonable frame structure, good application effect and can meet user's needs.The research results of this thesis for further study search and analysis of computer evidence, perfect computer forensics system have guiding significance.