【作者】 黄志勇；

【导师】 吴顺祥；

【作者基本信息】 厦门大学 ， 系统工程， 2008， 硕士

【摘要】 目前计算机取证的重点主要集中在简体中文操作系统中。随着国际交流的加强和我国改革开放的深入,以及涉及外国人的计算机案件量的不断增加。各省各地市缺乏精确高效的多语言后处理手段,使得涉及多语言的电子数据后处理工作诸多不便。当遇到此类案件的时候,往往让调查人员花费大量的时间。同时由于各自使用的手段方法不统一,也难于将各自的应用技术或方法推广与普及。本文研究的系统正是针对上面的一些问题,指出国内的信息分析系统和取证系统的不足,对中、日、韩三国的计算机常用编码规则进行深入分析与研究。通过给出取证搜索关键字在计算机中的可能的16进制编码的方式,让调查人员可以利用标准的计算机取证软件对16进制编码进行关键字搜索,从而实现案件线索的快速定位。为取证工作简化工作模式,在提高现有的工作质量前提下提高工作效率。本文首先阐述了基于中日韩的多国语言编码系统的重要意义,介绍了国内外计算机取证调查分析的现状;接着,详细研究了中日韩三国所涉及到的各种编码;然后,对这些编码的内容、特点、编码/解码原理及方法进行了深入的分析:本文以Unicode为核心编码,深入研究了中文的GB2312、BIG5、GBK等,日文的JIS、SHIFT_JIS、EUC-JP等,韩文的EUC-KR等本地编码规则,以及写字板的rtf,邮件的base64与QP编码,UTF-8等二次编码规则和Unicode编码,本系统支持直接批量导出为重要取证软件EnCase的关键字搜索脚本:然后,介绍了系统设计、运行环境、和具体实现的基本情况等;最后,对本系统的研究开发情况进行了总结,并就开发中的不足之处提出了下一步的努力方向。经过测试,本文研究的基于中日韩的多国语言编码系统能有效的提高取证人员的工作效率,扩大取证搜索的范围,为有力打击计算机犯罪活动提供了很好的应用工具。本系统还可用于纠正乱码,增强国际信息交流等多方面。同时该系统得到了很好的推广应用,具有较高的社会意义和实用价值。更多还原

【Abstract】 At present, the computer forensics put it’s emphases on Simplified Chinese in windows. Along frequently international communication and embedded reform and open policies, the cases about foreigners are increasing continuously. Because of the lack of precise multiplicate language tool to deal with, the investigators have to spend much time on the disposal of computer data. At the same time, to use the different methods make the technics difficult to spread.For the questions above, this paper analysed the shortage of information analysis and computer forensics system, and researched the computer code regulations in China, Japan, and Korea. Through giving the hex code of possible key words for search, let the investigators use standard software for computer forensics to search the key words easily and fleetly. So, it can predigest the work of forensics, and improve the work efficiency under the premise of work quality.This paper described the significance of the multi-language system based on Chinese, Japanese, and Korean firstly, introduced the island and overseas status quo of computer forensics. Then, it traversed most kind of codes which the computers in China, Japan, and Korea refer to. Then, used Unicode as kerneled code, lucubrated to the local codes, such as GB2312, BIG5, GBK, etc. in Chinese, JIS, SHIFT_JIS, EUC-JP, etc. in Japanese, EUC-KR, etc. in Korean; the quadratic codes such as rtf document, base64 and QP code; and the Unicode. The system sustain to export a batch EnCase’ scrips of key words search. Then the paper introduced the design of system, the environment to run, and basic circs to implement concretely. Finally, summarized the system development and on the lack propose the next step to make efforts.Through testings, the system discussed in paper can effectively improve the work efficiency, enlarge the range of forencis search, and provide a good tool for striking computer crimes. It also can correct unreadable codes, enhance the communication of international information. It has been generalized widely, and has high significance for society, and applied value.更多还原