数字取证

课程介绍 Course Introduction

学分：3 | 先修课：操作系统、计算机网络 | 学期：第7学期

数字取证课程研究电子证据的获取、保存、分析与呈现方法。内容包括磁盘取证、内存取证、网络流量取证、移动设备取证、文件系统分析（NTFS、EXT4）、数据恢复技术、隐写术检测、时间线分析等。学生将学习使用EnCase、Autopsy、Volatility等专业工具进行取证调查。

Digital Forensics studies methods for acquiring, preserving, analyzing, and presenting electronic evidence. Topics include disk forensics, memory forensics, network traffic forensics, mobile device forensics, file system analysis (NTFS, EXT4), data recovery techniques, steganography detection, and timeline analysis. Students learn to use professional tools such as EnCase, Autopsy, and Volatility for forensic investigation.

大作业 Final Project

作业标题：磁盘镜像取证分析

获取并分析给定磁盘镜像，使用Autopsy或FTK恢复已删除文件，分析注册表、系统日志与浏览器历史，重建用户活动时间线，撰写完整取证调查报告。

Acquire and analyze a given disk image, recover deleted files using Autopsy or FTK, analyze the registry, system logs, and browser history, reconstruct a user activity timeline, and submit a complete forensic investigation report.