关键词:  , 计算机取证, 动态取证, 证据完整性

Abstract: Along with the development of computer technology , traditional computer forensics model could not meet the requirements for safety. The new forensic model was proposed here. Camparing with traditional computer forensic model, the major differenced between these two models lies on the distributed structure and the mechanism of dynamical data gathering. With this two characteristics, forensics system based on the new model could gather real-time evidences dynamically in a distributed system, and save this evidences in a safe place in time. So unauthorised deletion ,change to evidences could be detected and prevented. Then the stored evidences could be used for further analysis and review.

Key words: computer forensics, dynamic forensics, integrality of evidence