作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2012, Vol. 38 ›› Issue (5): 262-265. doi: 10.3969/j.issn.1000-3428.2012.05.081

• 开发研究与设计技术 • 上一篇    下一篇

面向电子取证的网络多硬盘复制机研究

姚 伟,沙 晶,杨 涛   

  1. (公安部第三研究所信息网络安全公安部重点实验室,上海 201204)
  • 收稿日期:2011-07-13 出版日期:2012-03-05 发布日期:2012-03-05
  • 作者简介:姚 伟(1984-),男,硕士,主研方向:信息安全,计算机取证;沙 晶,副研究员、硕士;杨 涛,助理研究员、博士
  • 基金资助:
    公安部重点研究计划基金资助项目(2009ZDYJGASS 026);科技基础性工作专项基金资助项目(2008FY240200)

Research on Network Multiple Hard Disk Duplicator for Electronic Forensics

YAO Wei, SHA Jing, YANG Tao   

  1. (Key Lab of Information Network Security of Ministry of Public Security, The Third Research Institute of Ministry of Public Security, Shanghai 201204, China)
  • Received:2011-07-13 Online:2012-03-05 Published:2012-03-05

摘要: 传统基于硬盘复制机的一对一电子取证模式操作复杂、工作效率较低。为此,设计并实现一种面向电子取证的网络多硬盘复制机。通过iSCSI协议对多个远程硬盘进行数据备份,将数据镜像保存到高容量存储设备中,鉴定终端通过高速存储网络对镜像文件进行数据恢复、鉴定及虚拟分析。实验结果表明,该复制机能够快捷地对多个硬盘进行取证,复制速度约为6.5 GB/min。

关键词: 硬盘复制机, 高速存储网络, iSCSI协议, 数据备份

Abstract: Since the usual procedure of electronic forensic based on one-to-one cloning mode is too complicated and lack of efficiency, this paper proposes a network multiple hard disk duplicator for electronic forensics. It uses the iSCSI protocol to backup the data of many remote hard disk, and saves the data image to high capacity torage device. Identification terminal uses high-speed storage network to do data recovery identification and virtual analysis by the image files. Experimental results show that the duplicator has fast and high speed to obtain the evidence, and copy rate is about 6.5 GB/min.

Key words: hard disk duplicator, high-speed storage network, iSCSI protocol, data backup

中图分类号: