关键词: 中间件, 远程控制, 云取证, 物理内存

Abstract:

The rapid development of cloud computing not only has brought huge economic benefits, but also has brought the issue of computer related crimes. In this paper, a design method of cloud forensics middleware was proposed to obtain credible and complete digital evidence from the cloud in a comprehensive and convenient manner. The design method mainly included three parts: remote control end proofs, serverside evidence analysis and monitoring management, and clientside memory acquisition and analysis. Compared with the traditional online forensics methods, this method was more in line with the requirements of traditional physical evidence technology, greatly improving the efficiency of the forensic staff and the credibility of the evidence. The method has been verified on Windows 10 (the client) and Centos 7.0 (the server) and was proved to be effective and reliable.