关键词: 计算机取证, 证据保全, 数据完整性, 柯西RS码, 容错性

Abstract: Finegrained data integrity check to forensic copies can mitigate the disaster effect on the data by some random errors or intentional forging modification. An electronic evidence dispersing storage method is designed with the extra ability of fault tolerance. The idea is to improve their fault tolerance under the premise of ensuring the integrity of electronic evidence. The method distributes the electronic evidence to (p + q) data blocks. It generates fewer hash data to check the integrity of subblocks using the integrity indication code. In the case of no more than q error data blocks, it makes validity assessment in a fast check and recovers the original data. In the case of (q +e) (0＜e＜p) error data blocks, if each column of the error mapping matrix is not less than e elements of the value of 0, the original data is also recovered. The basic performance of the method is analyzed. The conclusion shows that adding a little additional hash data is able to obtain better data recovery effect. The method further enhances the fault tolerance and reliability of electronic evidence.

Key words: computer forensics;evidence preservation;data integrity;Cauchy ReedSolomon code;fault tolerance