Log-based computer evidence obtaining system

Abstract

The invention relates to a log-based computer forensics system. The system comprises a forensics server, forensics equipment, a database, a forensics management console, a target system and a forensics front end, The evidence obtaining device is connected with the evidence obtaining server, the database, the evidence obtaining management console and the target system. The database is also connected with the evidence obtaining management console; Wherein the target system is connected with the forensics front end; The forensics management console comprises a database management unit, a log forensics front-end management unit, a log recording unit, a log file storage and backup unit and a log data analysis and reporting unit; According to the system, the log file library is established, formats and default storage positions of most of system logs can be identified, and help is provided for understanding and analyzing log data; Meanwhile, log data collected by various systems can be imported into a database, keyword query and correlation analysis of various logs are carried out, and reports are generated and printed.

Description

technical field [0001] The invention relates to the technical field of forensics systems, in particular to a log-based computer forensics system. Background technique [0002] In recent years, with the rapid development of my country's information technology and information industry, computer technology, especially the Internet, has had great impact on various fields of national economic and social development, such as politics, economy, military, science and technology, culture, education, health and the daily life of the people. It has a wide and far-reaching influence, and at the same time provides new criminal space and means for criminals. Computer crime (ComPutercrime) presents an increasingly serious development trend, from the initial crime only targeting money, to crime targeting politics, military affairs, intellectual property and other fields; crime. Computer crime has caused a serious threat to national security and social stability, seriously endangering our c...

AI Technical Summary

Problems solved by technology

However, my country's law enforcement agencies still lack more effective technical means to combat computer crimes.

Various log files in the computer system are very important to the investigation and evidence collection of computer crime cases, but when we encounter computer crime cases, we have not taken effective measures to provide the system log as legal electronic evidence to the court. The problems are manifested in the following aspects: ignoring the protection of system logs, lack of log forensics solutions and technologies, lack of applied log forensics systems or tools, insufficient understanding of the format and content of log files of various systems, and the formation of invalid electronic evidence

Images