The Research on Forensic Model Based Network

Taking into account judicial forensic requirements and the characteristic of network forensics, a network dynamic forensic model is proposed, and the architecture and related rules of model are described. Based the presented model, a framework based on XML and plug-in techniques is designed. The framework uses plug-in technique which ensures the framework has good extensibility; meanwhile, the framework adopts encrypt and authentication technology which ensures collected evidence can be accepted by court. Subsequently, based on this framework, two algorithms on email forensics and specific information forensics in packet are proposed. The algorithm on email can analysis email information from network packets on SMTP protocol and HTTP protocol.