电子邮件分析取证系统的设计与实现

发布时间：2018-01-11 14:04

本文关键词：电子邮件分析取证系统的设计与实现　出处：《华南理工大学》2011年硕士论文　论文类型：学位论文

【摘要】：随着互联网技术的高速发展,人们通过互联网发送电子邮件,使得沟通交流变得更加容易、快捷。电子邮件也以其新型、快速、经济的特点已成为现代社会不可缺少的重要通信方式之一。与此同时,各种犯罪分子也开始普遍利用电子邮件从事各类违法犯罪活动,在很多计算机犯罪案件以及商业、民事纠纷中都涉及电子邮件。在电子邮件中蕴藏了丰富的各类有用信息,是进行计算机分析取证的重要内容之一,它能为案件侦破提供一些有力的线索。为提高使用效率,人们经常使用各类电子邮件客户端(如Foxmail、Outlook Express、Microsoft Office Outlook等)来处理邮件。因此,分析各类邮件客户端所保存的邮件数据文件也是计算机分析取证的重要手段之一。本文所研究的电子邮件分析取证系统主要是针对目前国内主流的Foxmail、Outlook Express和Office Outlook这三款邮件客户端。通过分析Foxmail所保存的.ind、.BOX格式的邮件文件、Outlook Express所保存的DBX的复合数据文件和Office Outlook所保存的PST复合邮件文件,从中提取感兴趣邮件的收发件人邮箱地址、收发件人姓名、发送时间、主题、邮件正文内容及附件等信息;然后统计归类收、发件人邮箱地址,运用可视化、人际网络分析等技术绘制邮件的时间关系图和人际网络关系图,从而为分析和发现收、发件人之间隐藏的关系提供很好的参考依据。本论文将首先简要说明电子邮件分析取证的背景、重要意义及目前国内外电子邮件分析取证的一些现状;接着,介绍系统的总体目标、运行环境、主要功能及总体架构,重点介绍系统各关键功能模块的设计思路、架构等情况;然后详细介绍在本系统设计和开发中所使用的关键技术:即基于文件结构分析的.ind、.BOX邮件数据文件解析、基于COM技术的DBX复合邮件体的解析、基于OLE自动化技术的PST邮件文件解析方法,以及在绘制邮件时间关系图和人际网络关系图中所使用到的图形绘制基础理论、数据库访问技术和基于遗传算法的图自动布局算法及实现等;接着,介绍整个系统的开发环境,并重点阐述如何运用前面提到的关键技术实现预期的系统用户界面和各项功能指标等,详细介绍了电子邮件分析取证系统的实现;最后总结本系统的设计实现开发情况,并针对所存在不足提出下步的研究方向。
[Abstract]:With the rapid development of Internet technology, people through the Internet to send e-mail, makes communication easier and faster. With its new e-mail, fast and economic characteristics has become one of the important means of communication in modern society indispensable. At the same time, all kinds of criminals also generally begin to use e-mail to engage in all kinds of criminal activities, in a lot of computer crime the case and commercial, civil disputes are involved in an email email. Contains all kinds of useful information, is one of the important contents of computer forensics analysis, it can provide some powerful clues for the detection of cases. In order to improve the efficiency, people often use various types of e-mail client (such as Foxmail, Outlook Express, Microsoft Office Outlook) to handle the mail. Therefore, analysis of various types of mail client saved The mail data file is also one of the important means of computer analysis and forensics.
This paper studies the e-mail forensic analysis system is mainly aimed at the current mainstream Foxmail, Outlook Express and Office Outlook these three e-mail client. Through the analysis of save Foxmail.Ind,.BOX format of the mail file, save to save Outlook Express DBX composite data files and Office Outlook PST composite mail file the extraction of interested mail sender email address from the sender to send, name, time, subject, message body content and attachments and other information; and then classified statistics, the sender email address, use visualization, social network analysis techniques such as drawing mail time diagram and network diagram, so as to analyze and found, which provides a good reference to hide the relationship between the sender.
This paper will first briefly explain the e-mail forensic analysis of the background, significance and present situation of domestic and foreign e-mail forensic analysis; then, the overall goal, introduces the running environment of the system, the main functions and overall structure design focuses on the key functional modules of the system architecture, etc.; and then introduces the key technologies used in the design and development of this system: Based on the analysis of.Ind file structure,.BOX mail data file parsing, parsing DBX composite mail COM technology based on the PST, the mail file analytical method based on OLE automation technology, and used to draw the mail in time diagram and interpersonal network diagram graphics draw the basic theory, database access technology and automatic layout algorithm based on genetic algorithm and implementation; then, introduces the development environment on the whole system, and On how to use the key technologies mentioned above to achieve the system user interface and the function index, introduced the realization of email forensics system analysis; finally summarizes the design and implement of the system development, and in view of the existing shortcomings of the next step.

【学位授予单位】：华南理工大学
【学位级别】：硕士
【学位授予年份】：2011
【分类号】：TP393.098;D918.2

【参考文献】