A computer forensic system based on multi-leveled marks mining

With the rapid development of information technology, computer crimes become very serious. However, traditional computer forensic has inherent limitations. Any modification, edit, removal, or cover, whether are caused by external force or human factors of electronic evidence, are difficult to distinguish technically. To solve these problems, we have implemented a computer forensic system based on multi-leveled marks mining to mine the marks as wide as possible, as soon as possible, and to fix evidence information supporting anti-repudiation. This paper describes the architecture and key technology of the computer forensic system in detail, as well as system implementation and experimental analysis.