Digital forensics XML and the DFXML toolset
Digital forensics XML and the DFXML toolset
复制标题
DOI：
10.1016/j.diin.2011.11.002
复制
发表时间：
2012-02-01
影响因子：
--
通讯作者：
Garfinkel, Simson
中科院分区：
文献类型：
--
作者：
Garfinkel, Simson
数字取证XML（DFXML）是一种XML语言，它支持交换结构化的取证信息。DFXML可以表示受取证调查影响的数据的来源，记录文件系统、文件、Microsoft Windows注册表条目、JPEG EXIF以及取证分析师感兴趣的其他技术信息的存在和位置。DFXML还可以记录用于产生结果的特定工具和处理技术，使得随着工具的改进而自动重新处理取证信息成为可能。本文介绍了DFXML的动机、设计和使用。它还讨论了既可以接收又可以发出DFXML文件的工具。爱思唯尔有限公司出版
Digital Forensics XML (DFXML) is an XML language that enables the exchange of structured forensic information. DFXML can represent the provenance of data subject to forensic investigation, document the presence and location of file systems, files, Microsoft Windows Registry entries, JPEG EXIFs, and other technical information of interest to the forensic analyst. DFXML can also document the specific tools and processing techniques that were used to produce the results, making it possible to automatically reprocess forensic information as tools are improved.This article presents the motivation, design, and use of DFXML. It also discusses tools that have been creased that both ingest and emit DFXML files. Published by Elsevier Ltd.