时间戳计算机网络,计算机取证中时间戳问题的研究1-江苏省计算机网络技术重点实验室.PDF...

计算机取证中时间戳问题的研究1-江苏省计算机网络技术重点实验室

1

2

Study on Time-Stamp Issues about Computer Forensics

Abstract: In the investigation of a criminal case involving a computer or computer network, the

timeline of events may help to reconstruct the scenario of criminal, can determine whether the

suspects have chance to commit a crime, even can help to ultimately determine the guilt or

innocence of those who facing criminal charges. The computer system provides time-stamp

functions, which can help us construct correct timeline of the event during computer forensics.

This paper introduces the conception of computer forensics and characteristics of electronic

evidence. We give a summary of the function of time-stamp and relative issues in computer

forensics. Finally, we provide the methods of computer forensics with time-stamp.

Key word: computer forensics, electronic evidence, time-stamp

1

International Association of Computer Specialist (IACS)1991

1 BM2003201

21