“运行”计算机内“易挥发数据”的取证问题

当前司法实践中对现场中处于运行状态的计算机大多采用“二步式”取证的方式来收集数字证据,即先由侦查人员对涉案计算机实施关机分离和保全,尔后再移交专业机构进行数字证据司法鉴定。该方法虽保障了数字证据的原始性和证明力,但无形之中却造成了存储于RAM中的“易挥发”数据以及其他形式的潜在数字证据的丢失。而计算机信息系统中的这些“易挥发数据”可为案件的侦破提供重要线索和潜在的数字证据,因此进行现场动态分析,收集这些“易挥发数据”对数字案件侦查取证意义重大。

On the Issue of Collecting Evidence from Running Computer

In today's judicial practice,thetwo-stepsapproach is commonly used to collect digital evidence in running computer on crime scene,namely the investigator just implement the duty of unplug the running computer and book it into the evidence facility,from there,the investigator requests that the computer be examined by a trained digital evidence examiner.This method protects the aboriginality and integrity of digital evidence,but in anyway leads to the loss ofvolatile datastorage in RAM,as well as other forms ...