网络取证系统的技术分析与模型实现

首先分析了网络取证的基本概念，然后介绍了网络取证系统的分析过程，最后提出和设计了一个分布式网络实时取证系统的实现模型。     

Windows系统中文件时间属性的变化及影响因素

目的分析Windows系统中不同因素对文件时间属性的影响,总结文件时间属性的变化规律。方法在FAT32和NTFS两种文件系统中,对文件和文件夹进行各种操作,记录其时间属性的变化情况,总结其规律并分析各种因素的影响。结果文件时间属性的更新与系统环境、操作方法、文件类型等因素有关,而且文件时间属性更新有特定的周期。结论Windows系统中文件时间属性的变化既有特定的规律,又受其它因素影响,在检验中应加以注意。     

电子取证中AVI文件的文件雕复

用电子取证中的文件雕复相关技术,并以AVI文件为实例,阐述一种侦测AVI文件碎片,并将碎片排序组合成完整文件的文件雕复方法。通过实例的文件雕复方法基于AVI文件格式的结构特征,借鉴了文件结构关键字匹配,二分碎片间隙雕复等文件雕复思想来完成实验。此方法能在失去系统元信息的情况下完成对AVI文件的文件雕复。实验结果表明,此方法提高了有碎片的AVI文件的雕复成功率。     

Trust in digital records: An increasingly cloudy legal area

Trust has been defined in many ways, but at its core it involves acting without the knowledge needed to act. Trust in records depends on four types of knowledge about the creator or custodian of the records: reputation, past performance, competence, and the assurance of confidence in future performance. For over half a century society has been developing and adopting new computer technologies for business and communications in both the public and private realm. Frameworks for establishing trust have developed as technology has progressed. Today, individuals and organizations are increasingly saving and accessing records in cloud computing infrastructures, where we cannot assess our trust in records solely on the four types of knowledge used in the past. Drawing on research conducted at the University of British Columbia into the nature of digital records and their trustworthiness, this article presents the conceptual archival and digital forensic frameworks of trust in records and data, and explores the common law legal framework within which questions of trust in documentary evidence are being tested. Issues and challenges specific to cloud computing are introduced.     

电子数据鉴定标准体系研究

结合电子数据鉴定实务与实验室管理体系建设的需求,在分析国内外电子数据鉴定标准化现状的基础上,提出了电子数据鉴定标准体系的整体框架及其组成,并分析了标准研制的关键技术问题。     

Comments on the Linux FAT32 allocator and file creation order reconstruction [Digit Investig 11(4), 224–233]

Minnaard proposed a novel method that constructs a creation time bound of files recovered without time information. The method exploits a relationship between the creation order of files and their locations on a storage device managed with the Linux FAT32 file system. This creation order reconstruction method is valid only in non-wraparound situations, where the file creation time in a former position is earlier than that in a latter position. In this article, we show that if the Linux FAT32 file allocator traverses the storage space more than once, the creation time of a recovered file is possibly earlier than that of a former file and possibly later than that of a latter file on the Linux FAT32 file system. Also it is analytically verified that there are at most n candidates for the creation time bound of each recovered file where n is the number of traversals by the file allocator. Our analysis is evaluated by examining file allocation patterns of two commercial in-car dashboard cameras.     

Windows系统存储区DPAPI的解密技术研究

目的 在电子数据取证过程中,数据的加解密经常是取证人员关注的重点.数据保护接口(DPAPI)作为Windows系统提供的数据保护接口被广泛使用,目前主要用于保护加密的数据.其特性主要表现在加密和解密必须在同一台计算机上操作,密钥的生成、使用和管理由Windows系统内部完成,如果更换计算机则无法解开DPAPI加密数据....     

An updated validation of Promega's PowerPlex 16 System: high throughput databasing under reduced PCR volume conditions on Applied Biosystem's 96 capillary 3730xl DNA Analyzer

The PowerPlex 16 System from Promega Corporation allows single tube multiplex amplification of sixteen short tandem repeat (STR) loci including all 13 core combined DNA index system STRs. This report presents an updated validation of the PowerPlex 16 System on Applied Biosystem's 96 capillary 3730xl DNA Analyzer. The validation protocol developed in our laboratory allows for the analysis of 1536 loci (96 x 16) in c. 50 min. We have further optimized the assay by decreasing the reaction volume to one-quarter that recommended by the manufacturer thereby substantially reducing the total cost per sample without compromising reproducibility or specificity. This reduction in reaction volume has the ancillary benefit of dramatically increasing the sensitivity of the assay allowing for accurate analysis of lower quantities of DNA. Due to its substantially increased throughput capability, this extended validation of the PowerPlex 16 System should be useful in reducing the backlog of unanalyzed DNA samples currently facing public DNA forensic laboratories.     

Avoiding the internet of insecure industrial things

Security incidents such as targeted distributed denial of service (DDoS) attacks on power grids and hacking of factory industrial control systems (ICS) are on the increase. This paper unpacks where emerging security risks lie for the industrial internet of things, drawing on both technical and regulatory perspectives. Legal changes are being ushered by the European Union (EU) Network and Information Security (NIS) Directive 2016 and the General Data Protection Regulation 2016 (GDPR) (both to be enforced from May 2018). We use the case study of the emergent smart energy supply chain to frame, scope out and consolidate the breadth of security concerns at play, and the regulatory responses. We argue the industrial IoT brings four security concerns to the fore, namely: appreciating the shift from offline to online infrastructure; managing temporal dimensions of security; addressing the implementation gap for best practice; and engaging with infrastructural complexity. Our goal is to surface risks and foster dialogue to avoid the emergence of an Internet of Insecure Industrial Things.