计算机工程与信息技术学报

Modern Technologies for Electronic Forensics

Junjie Xu

With the rapid development of cyberspace technology, electronic forensics technology has become one of the important research directions in the field of cyberspace security defense. This article focuses on the application technology of electronic forensics, and the forensics technology is divided into three categories according to the technology and method of forensics: computer forensics, mobile forensics, and network forensics. The introduction of computer forensics technology in this article is mainly based on Windows and Mac systems, including browser forensics, mail forensics and memory forensics in Windows, as well as log files, diagnostic reports, crash logs, and plist files in Mac. Mobile forensics is mainly divided into manual extraction, logical forensics, physical forensics, chip disassembly, and microcode reading, based on Android and iOS. Finally, this article briefly explains two methods of network forensics: server forensics and router forensics