计算机系统遭到犯罪入侵后的电子证据取证

电子证据没有传统证据所拥有的永恒性,电子犯罪的调查和起诉,调查人员必须根据在某种交易已经完成后的记录来立案。一旦探测到受到入侵,你有两种选择方案来对付—将系统和网络断开,开始取证,或者仍旧让系统联网,尝试监控入侵者。利用正确的工具,具备所有器件如何工作的知识,就是收集所需证据需要的一切。

On Means of Obtaining Electronic Evidence after the Criminal Invasion of the Computer System

Electronic evidence cannot last as long as traditional evidence. Investigators of electronic crime place a case on file according to the record of completing a trade. Once checked to have been invaded, the computer system can be cut off from the internet to begin obtaining evidence, or as an alternative, the system can be still on line to monitor the invaders. Necessary evidence can be obtained with proper tools and knowledge of how all parts work in a computer system.