The Application of Compound Document Storage Technology in Forensic Analysis System

Due to the special nature of electronic data, we need to create a complete copy of the raw disks before computer forensics. There is two ways to create a copy. One is copy from Disk to disk, another is disk mirroring. The former capacity of the copy disk has fixed while image file of the latter is highly compressed already. Neither any of them can add the forensic analysis evidence; it will be handed over to the court as a whole set of evidence. This will affect the completeness and admissibility of the evidence. In this thesis, we will take the disk mirroring and storage technology into consideration by using the Compound Document storage technology, by this way we can add the evidence into the evidence copy which makes an “evidence gathered” effect. At the same time, it can highly compressed the original evidence, save the capacity and ensure the safety of the data.