计算机取证相关问题研究——现场动态分析，获取“易挥发”数字证据

当前司法实践中对于现场中运行正处于运行状态的计算机大多采用“二步式”取证的方式来搜集数字证据，这种方式虽然保障了数字证据的原始性和证明力，但无形之中造成了存储在RAM中的“易挥发”数据以及其他形式的潜在数字证据的丢失。计算机信息系统中的这些“易挥发数据”可以为案件的侦破提供重要线索和潜在的数字证据，因此通过对侦查人员的专业培训，实现“易挥发数据”的现场动态分析获取和合理保全无疑对数字案件侦查取证意义重大。

A Research on Issues Concerning Computer Forensics A Dynamic Analysis of the Scene to Obtain "Volatile" Digital Evidence

In the present judicial practice, investigators mostly take a＂two- step＂approach to gathering digital evidence from the running computer at crime scenes. This method secures the originality and the testifying power of the digital evidence,but it unnoticeably leads to the loss of＂voatile data＇stored in RAM,as well as the potential digital evidence in other forms. These＂volatile clara＂left in computer information systems can provide important clues and potential digital evidence for criminal investigators. Thus giving investigators a professional training and achieving the dynamic analysis of the scene in order to collect and preserve the＂volatile data＇is undoubtedly very significant to investigate the digital cases and collect their evidence.