从不可见数据获得计算机犯罪证据和线索

有经验的犯罪分子都会尽可能地销毁在系统中留下的痕迹,他们使用的方法通常是删除系统日志和相关文件。因此取证工作往往需要从不可见数据中获得证据和线索,通过特定的技术手段进行分析还原电子证据的真实形态,为案件提供证据支持。

Obtaining Evidence and Clues on Computer-related Crime from Unseen Data

Experienced criminal offenders vail destroy as much evidence as possible to avoid leaving a trail in the system. Often, the method that they use is to delete the daily articles and related files. Thus, the work of evidence-collection often requires obtaining evidence and clues from unseen data, using special technical methods to restore electronic evidence to its real state in order to provide proof and support for the case.