CN103092672B - A kind of virtual computer dynamic stimulating method starting intelligence and repair - Google Patents
A kind of virtual computer dynamic stimulating method starting intelligence and repair Download PDFInfo
- Publication number
- CN103092672B CN103092672B CN201210485194.XA CN201210485194A CN103092672B CN 103092672 B CN103092672 B CN 103092672B CN 201210485194 A CN201210485194 A CN 201210485194A CN 103092672 B CN103092672 B CN 103092672B
- Authority
- CN
- China
- Prior art keywords
- content
- virtual
- startup
- virtual container
- startup content
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Stored Programmes (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The present invention relates to a kind of virtual computer dynamic stimulating method starting intelligence and repair, the startup content overcome due to virtual environment is incorrect, and the emulation failure caused, cannot carry out simulating the problem of reappearing, realize virtual startup intelligence and repair.Method of the present invention automatically can solve rapidly dynamic simulation Windows operating system, (SuSE) Linux OS, start unsuccessfully based on the virtual environment such as Macintosh operating system, Unix operating system of X86-based, cause the situation cannot simulating the original state of playback system, ensure that effective work well of judicial personnel.Method of the present invention greatly can improve the work efficiency of judicial personnel, can avoid carrying out effective judicial work because emulation is collected evidence unsuccessfully and cause judicial the delay and other consequence.Significantly will reduce job costs, alleviate working pressure, and improve ability to work, wide application and market outlook must be had.
Description
Technical field
The present invention relates to the method for a kind of computer dynamic stimulating evidence obtaining, more particularly, relate to a kind of virtual computer dynamic stimulating method starting intelligence and repair.
Background technology
According to the difference of computer forensics state, generally computer forensics is divided into dynamic online evidence obtaining and static post-mordem forensics.Traditional static evidence mode is understood based on to the off-line of the electronic data in computing machine associated storage device and is analyzed.Set the writing of electronic data is needed to deposit and good data storage environment.If data fail write associated storage device or evidence obtaining condition undesirable when, the effect of static evidence will be had a greatly reduced quality.For example, the loss that the power-off operation static evidence carried out again afterwards will cause some important instant data in evidence obtaining destination host is first implemented to operating computer information system.Instant data are clear data mostly, wherein may contain solution password, the operation logout of each class method, the information such as write record, network instant communication data record of virtual memory of various ciphertext, these information finally can't be written in the memory device of computer system, and it can be died away along with the operation termination of system.Many times, obtaining these instant data can make evidence obtaining get twice the result with half the effort, thus its importance is also more and more subject to the attention of juridical authorities. but obtain these data and need carrying out online of evidence obtaining and study and judge dynamically to analyze to save from damage with collection, adopt static post-mordem forensics cannot meet the needs of instant data acquisition.
In addition, the data that static evidence obtains are all kinds of result datas that computer system is run. have what association between all kinds of electronic data how all kinds of electronic data is formed, obtained, which kind of operation user carried out in advance, the problem such as reason of data variation according to the method for static evidence afterwards, from result data, be difficult to the reason that these data of presumption produce, change, loss.Further, static evidence is difficult to reappear electronic data first in running environment, in the face of the electronic data of magnanimity, the accuracy of static evidence, the efficiency of evidence obtaining are greatly affected.
For satisfied evidence obtaining performance analysis actual needs, make up the deficiency of static post-mordem forensics.Along with computer simulation technique, disk redirect the research application of the computer technology such as technology, ShadoW, the technical conditions of computer dynamic stimulating forensic applications possess.Computer dynamic stimulating is widely used in the middle of various judicial evidence collection at present, uses dynamic simulation can reappear the original state of simulation objectives, operates, launch work of effectively collecting evidence at a high speed in the environment that judicial personnel can reappear in simulation.But, certain situation (as virtual environment assembly or its system information database content incorrect etc.), virtual environment often creates failure, cannot simulate and reappear original state, directly cause emulating unsuccessfully.
As Chinese invention patent application 200910194667.9 provides a kind of implementation method of computer virtualized evidence obtaining, by starting in virtualized mode in evidence obtaining dedicated computer system, obtain by the same operation interface and environment after evidence obtaining computer system starting, the raw data of memory device can not be rewritten, guarantee to modify to by the file on evidence obtaining memory device in evidence obtaining process, when carrying out evidence obtaining operation in virtualized environment, what see is no longer only file on computer-readable storage medium and data, operating system environment and user environment can also be seen, operate also convenient, realize object of the present invention.
But the startup content that technical scheme disclosed in foregoing invention application cannot solve due to virtual environment is incorrect, and the emulation failure caused.As incorrect in the startup content in the physical disks/mirror image of destination OS etc., emulation will be failed, cannot carry out simulation and reappear.Prior art does not also have effective approach for solving the problem.
Summary of the invention
The object of the invention is to overcome the deficiencies in the prior art, provide a kind of startup content overcome due to virtual environment incorrect, and the emulation failure caused, cannot carry out simulating the problem of reappearing, realize the virtual computer dynamic stimulating method starting intelligence and repair.
Method of the present invention, for there being now technology Problems existing, not only can produce the effect of essence, can deal with problems comprehensively, and has remarkable must expansion on the range supported.Its object supported includes but not limited to: Windows2000, WindowsXP(x86, x64), Windows2003(x86, x64), WindowsVista(x86, x64), Windows2008(x86, x64), Windows7(x86, x64), Windows8(x86, x64), each version Linux, based on the Macintosh of X86-based, Unix operating system.
Technical scheme of the present invention is as follows:
The virtual computer dynamic stimulating method starting intelligence and repair, comprises step:
1) the startup content of normal target is defined, to all kinds of start-up loading content creating database tables of the virtual machine of normal work; Define the startup content got from normal target, the startup content of normal target is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
2) according to the startup content of the normal target of step 1), by virtual reconstruction technology, be virtual container the object reconstruction be present in for the virtual presence of simulation object;
3) the startup content in defining virtual container, to step 2) all kinds of start-up loading content creating database tables in the virtual container that obtains; The startup content retained in defining virtual container; Startup content in virtual container is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
4) definition starts the configuration vestige of content, determines the startup content revised for the needs of simulation object or replace according to the startup content retained in the virtual container of step 3), and record;
5) scanning step 3) virtual container in startup content, step 4) the configuration vestige of startup content, the startup content for retaining in each virtual container of simulation object is revised one by one or is replaced;
6) analyse structure technology by virtual, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern;
7) again emulate for simulation object, the virtual startup being virtual environment is repaired completely.
As preferably, if the interior startup content retained of virtual container that step 3) obtains is for empty, then by virtual structure technology of analysing, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern, emulate and terminate.
As preferably, the startup content retained in the startup content in the startup content of described normal target, the startup content got from normal target, virtual container, virtual container, the configuration vestige starting content are the tables of data space of self-propagation.
As preferably, the startup content in virtual container is scanned described in the startup content of normal target is scanned described in step 1), step 3), scanning step 3 described in step 5)) virtual container in startup content, step 4) the configuration vestige of startup content, scan mode is use the tables of data space of SCAN algorithm to self-propagation to carry out scanning by building.
As preferably, step 2) described in virtual container be physically in the valid data district of native operating sys-tern.
As preferably, in step 5), the startup content for retaining in each virtual container of simulation object modified or before the operation of replacing, legitimate verification is carried out to current operation, if operate legal, then carrying out current operation, otherwise ignore.
As preferably, described legitimate verification is specially and the startup content designator starting the configuration vestige of content and the startup content in virtual container, data content is mated, coupling is consistent then by legitimate verification, otherwise authentication failed, amendment or the operation of replacing are left in the basket.
As preferably, in step 5), the startup content for retaining in each virtual container of simulation object is modified or replaced, for the content of operating system acquiescence restriction amendment, the protection attribute of first lifting operation authority or change content, then modify or replace.
As preferably, all kinds of start-up loading contents of the virtual machine of the normal work described in step 1), step 3) comprise: system starts execute file, and system starts base, and system starts and controls, System guides item.
As preferably, the configuration vestige of the startup content described in step 4) comprises: the system that user will revise starts execute file, and the system that user will revise starts base, and the system that user will revise starts and controls, the System guides item that user will revise.
Beneficial effect of the present invention is as follows:
Method of the present invention automatically can solve rapidly dynamic simulation Windows operating system, (SuSE) Linux OS, start unsuccessfully based on the virtual environment such as Macintosh operating system, Unix operating system of X86-based, cause the situation cannot simulating the original state of playback system, ensure that effective work well of judicial personnel.
Method of the present invention greatly can improve the work efficiency of judicial personnel, can avoid carrying out effective judicial work because emulation is collected evidence unsuccessfully and cause judicial the delay and other consequence.Significantly will reduce job costs, alleviate working pressure, and improve ability to work, wide application and market outlook must be had.
Accompanying drawing explanation
Fig. 1 is schematic flow sheet of the present invention.
Embodiment
Below in conjunction with drawings and Examples, the present invention is described in further detail.
The virtual computer dynamic stimulating method starting intelligence and repair, comprises step:
1) the startup content of normal target is defined, to all kinds of start-up loading content creating database tables of the virtual machine of normal work; Define the startup content got from normal target, the startup content of normal target is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
2) according to the startup content of the normal target of step 1), by virtual reconstruction technology, be virtual container the object reconstruction be present in for the virtual presence of simulation object;
3) the startup content in defining virtual container, to step 2) all kinds of start-up loading content creating database tables in the virtual container that obtains; The startup content retained in defining virtual container; Startup content in virtual container is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
4) definition starts the configuration vestige of content, determines the startup content revised for the needs of simulation object or replace according to the startup content retained in the virtual container of step 3), and record;
5) scanning step 3) virtual container in startup content, step 4) the configuration vestige of startup content, the startup content for retaining in each virtual container of simulation object is revised one by one or is replaced;
6) analyse structure technology by virtual, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern;
7) again emulate for simulation object, the virtual startup being virtual environment is repaired completely.
If the startup content retained in the virtual container that step 3) obtains is for empty, then by virtual structure technology of analysing, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern, emulation terminates.
The startup content retained in startup content in the startup content of described normal target, the startup content got from normal target, virtual container, virtual container, the configuration vestige starting content are the tables of data space of self-propagation.
The startup content in virtual container is scanned described in the startup content of normal target is scanned described in step 1), step 3), scanning step 3 described in step 5)) virtual container in startup content, step 4) the configuration vestige of startup content, scan mode is use the tables of data space of SCAN algorithm to self-propagation to carry out scanning by building.
Step 2) described in virtual container be physically in the valid data district of native operating sys-tern.Virtual reconstruction technology can utilize the software of prior art (as VMMount) that data virtual is become a subregion (subregion that drive is Z as invented).
All kinds of start-up loading contents of the virtual machine of the normal work described in step 1), step 3) comprise: system starts execute file, and system starts base, and system starts control, System guides item.
The configuration vestige of the startup content described in step 4) comprises: the system that user will revise starts execute file, and the system that user will revise starts base, and the system that user will revise starts control, the System guides item that user will revise.
In step 5), before the operation of modifying for the startup content that retains in each virtual container of simulation object or replace, legitimate verification is carried out to current operation, if operate legal, then carry out current operation, otherwise ignore.
Described legitimate verification is specially and the startup content designator starting the configuration vestige of content and the startup content in virtual container, data content is mated, coupling unanimously then passes through legitimate verification, otherwise authentication failed, amendment or the operation of replacing are left in the basket.
In step 5), the startup content for retaining in each virtual container of simulation object is modified or replaced, for the content of operating system acquiescence restriction amendment, the protection attribute of first lifting operation authority or change content, then modify or replace.
Virtual structure technology of analysing in step 6) can utilize the software of prior art (as VMMount) that virtual container is deleted (as inventing the subregion deletion that drive is Z).
Embodiment
As shown in Figure 1, method step of the present invention is as follows:
1, the startup content of normal target is defined:
S1={i1,i2,i3,…,in}
S2={i1,i2,i3,…,in}
S3={i1,i2,i3,…,in}
Sn={i1,i2,i3,…,in}
Define the startup content got from normal target:
D1={i1,i2,i3,…,in}
D2={i1,i2,i3,…,in}
D3={i1,i2,i3,…,in}
Dn={i1,i2,i3,…,in}
Respectively self-propagation space etc. is created to the startup content every " floor " of the virtual machine of normal work in advance to be operated.S1, S2, S3, Sn is all kinds of startup contents of normal target.D1, D2, D3, Dn be use elevator algorithm (i.e. SCAN algorithm) " by building scanning " from all kinds of startup content obtainings of normal target to qualified, the information that is kept at often " floor " corresponding self-propagation space.Wherein D1 ∈ S1, D2 ∈ S2, D3 ∈ S3, Dn ∈ Sn.Described elevator algorithm, also known as SCAN algorithm, is a kind of fair algorithm, to the database table space of self-propagation from request start address, up scans by building.In C, C++, java, all have disclosed implementation method, the present invention repeats no more.Described condition is the identifier for the content needed for simulation object startup, and the identifier of the content needed for the identifier of the eligible i.e. all kinds of startup contents of normal target and wish simulation object start can match each other, then obtain qualified startup content.S1, S2, S3, the information of Sn have for starting content, what have is non-start up content.
The startup content of the virtual machine of normal work specifically comprises: system starts execute file, and system starts base, and system starts control, System guides item etc.Element in set is its subitem.
2, by virtual reconstruction technology, be a virtual container the object reconstruction of the virtual presence being present in simulated target.Virtual container is equivalent to a valid data district of native operating sys-tern physically, and to its any operation just as the local data of operation, any API of system is effective to it, comprises the operations such as document creation, read-write, deletion.But the reconstruct of virtual container, analysing structure and read-write can not to local or be connected to local remote content and have any impact.
3, the startup content in defining virtual container:
VS1={i1,i2,i3,…,in}
VS2={i1,i2,i3,…,in}
VS3={i1,i2,i3,…,in}
VSn={i1,i2,i3,…,in}
The startup content retained in defining virtual container:
VD1={i1,i2,i3,…,in}
VD2={i1,i2,i3,…,in}
VD3={i1,i2,i3,…,in}
VDn={i1,i2,i3,…,in}
It is to be operated that startup content in the virtual container obtained step 2 respectively in advance every " floor " creates self-propagation space etc.VD1, VD2, VD3, VDn is for using elevator algorithm " by building scanning " VS1, D1, VS2, D2, VS3, D3, VSn, Dn, the content that often " floor element " will retain specifically according to its attribute reserve, then separately will be retained in " floor " corresponding self-propagation space for the another reservation of condition hit, hits and separately do not retain, skip over for condition.Wherein VD1 ∈ VS1, VD2 ∈ VS2, VD3 ∈ VS3, VDn ∈ VSn.Here scanning radiation is to startup content item names, or its display, or it is described as empty situation, retains and skips over and all can process in algorithm in the hit of these situations, unnatural death, separately.Described condition is the identifier for the content needed for simulation object startup, and the identifier of the content needed for the identifier of each startup content in eligible i.e. virtual container and wish simulation object start can match each other, then obtain qualified startup content.
4, definition starts the configuration vestige of content:
T1={t1,t2,t3,…,tn}
T2={t1,t2,t3,…,tn}
T3={t1,t2,t3,…,tn}
Tn={t1,t2,t3,…,tn}
The VD1 of step 3, VD2, VD3, VDn feeds back to simulation operator by UI form, and UI display comprises startup content name, starts description of contents description etc., and provides 3 selections:
Selection 1, " the virtual startup of computer dynamic stimulating is intelligent repairs " configure these startup content, then reservation operations vestiges for emulating user automatically;
Selection 2, emulation user can manually be configured the startup content of UI display, then operate vestige and are automatically retained;
Select 3, do not carry out any operation.
Here to should be mentioned that especially, no matter be automatic or manual, operation vestige all can be carried out full method and be verified, whether verify effectively legal, whether damage is caused to the virtual presence of simulated target, if that is necessary then the retaining of some vestige is not to be retained.Proof procedure is completely transparent to emulation user.Legitimate verification is specially the startup content designator of the startup content in the configuration vestige of startup content and virtual container, data content (fix, and repeats no more herein by data content form in a variety of systems.) mate, coupling is consistent then by legitimate verification, otherwise authentication failed, amendment or the operation of replacing are left in the basket.
Configuration vestige: the system that user will revise starts execute file, the system that user will revise starts base, and the system that user will revise starts control, the System guides item that user will revise.Element in set is its subitem.
5, " elevator scanning " VS1, T1, VS2, T2, VS3, T3, VSn, Tn, according to startup content configuration vestige to VS1, VS2, VS3, VSn operates, and drops between condition portion and then operates, then inoperation outside between condition portion.For needing to carry out operating in condition portion due to the situation that the reasons such as system property cannot be carried out, then force to carry out by special pathway, the operation be necessary all will ensure that carrying out " the virtual startup intelligence of computer dynamic stimulating is repaired " function just can come into force.
For starting startup content designator, the data content of the configuration vestige of content between described condition portion.Drop in condition portion, the startup content designator, the data content that are about to start the configuration vestige of content and the startup content in virtual container mate, and coupling unanimously.
Described needs carry out operating and situation about cannot carry out due to reasons such as system propertys, and as active user's Insufficient privilege, or file is read only attribute.For modifying to it or replacing, can the protection attribute of first lifting operation authority or change content, then modify or replace.
6, structure technology is analysed by virtual, the virtual container of the virtual presence of simulated target from safety deleting native operating sys-tern, mentioned above, all can not to local or be connected to other local content and have any impact to any operation of virtual container.
7, institute correct in steps after, again simulated object is emulated, just can solve situation that virtual startup brings and successfully enter virtual environment and carry out relevant evidence obtaining and operate.
Above-described embodiment is only used to the present invention is described, and is not used as limitation of the invention.As long as according to technical spirit of the present invention, change above-described embodiment, modification etc. all will be dropped in the scope of claim of the present invention.
Claims (9)
1. the virtual computer dynamic stimulating method starting intelligence and repair, is characterized in that, comprise step:
1) the startup content of normal target is defined, to all kinds of start-up loading content creating database tables of the virtual machine of normal work; Define the startup content got from normal target, the startup content of normal target is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
2) according to step 1) the startup content of normal target, by virtual reconstruction technology, be virtual container the object reconstruction be present in for the virtual presence of simulation object;
3) the startup content in defining virtual container, to step 2) all kinds of start-up loading content creating database tables in the virtual container that obtains; The startup content retained in defining virtual container; Startup content in virtual container is scanned, if the content of the content scanned needed for the startup of wish simulation object, then record, otherwise ignore;
4) the configuration vestige of definition startup content, configuration vestige comprises: the system that user will revise starts execute file, and the system that user will revise starts base, and the system that user will revise starts control, the System guides item that user will revise; According to step 3) virtual container in the startup content that retains determine needs amendment for simulation object or the startup content of replacing, and record;
5) scanning step 3) virtual container in startup content, step 4) the configuration vestige of startup content, the startup content for retaining in each virtual container of simulation object is revised one by one or is replaced;
6) analyse structure technology by virtual, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern;
7) again emulate for simulation object, the virtual startup reparation being virtual environment completes.
2. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 1, it is characterized in that, if step 3) the startup content that retains in the virtual container that obtains is for empty, then analyse structure technology by virtual, the virtual container of the virtual presence for simulation object is deleted from native operating sys-tern, and emulation terminates.
3. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 1 and 2, it is characterized in that, the startup content retained in the startup content in the startup content of described normal target, the startup content got from normal target, virtual container, virtual container, the configuration vestige starting content are the tables of data space of self-propagation.
4. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 3, it is characterized in that, step 1) described in the startup content of normal target is scanned, step 3) described in the startup content in virtual container is scanned, step 5) described in scanning step 3) virtual container in startup content, step 4) the configuration vestige of startup content, scan mode is use the tables of data space of SCAN algorithm to self-propagation to carry out scanning by building.
5. according to claim 1 and 2 virtual start intelligence repair computer dynamic stimulating method, it is characterized in that, step 2) described in virtual container be physically in the valid data district of native operating sys-tern.
6. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 1 and 2, it is characterized in that, step 5) in, before the operation of the startup content for retaining in each virtual container of simulation object being modified or replace, legitimate verification is carried out to current operation, if it is legal to operate, then carries out current operation, otherwise ignore.
7. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 6, it is characterized in that, described legitimate verification is specially and the startup content designator starting the configuration vestige of content and the startup content in virtual container, data content is mated, coupling unanimously then passes through legitimate verification, otherwise authentication failed, amendment or the operation of replacing are left in the basket.
8. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 1 and 2; it is characterized in that; step 5) in; startup content for retaining in each virtual container of simulation object is modified or replaced; for the content of operating system acquiescence restriction amendment; the protection attribute of first lifting operation authority or change content, then modify or replace.
9. the virtual computer dynamic stimulating method starting intelligence and repair according to claim 1 and 2, it is characterized in that, step 1), step 3) described in all kinds of start-up loading contents of virtual machine of normal work comprise: system starts execute file, system starts base, system starts control, System guides item.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210485194.XA CN103092672B (en) | 2012-11-23 | 2012-11-23 | A kind of virtual computer dynamic stimulating method starting intelligence and repair |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210485194.XA CN103092672B (en) | 2012-11-23 | 2012-11-23 | A kind of virtual computer dynamic stimulating method starting intelligence and repair |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103092672A CN103092672A (en) | 2013-05-08 |
| CN103092672B true CN103092672B (en) | 2016-01-20 |
Family
ID=48205282
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210485194.XA Active CN103092672B (en) | 2012-11-23 | 2012-11-23 | A kind of virtual computer dynamic stimulating method starting intelligence and repair |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103092672B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107168819B (en) * | 2017-03-31 | 2020-02-28 | 北京奇艺世纪科技有限公司 | Method and device for restarting operating system |
| CN109344464A (en) * | 2018-09-14 | 2019-02-15 | 河南职业技术学院 | A kind of computer dynamic stimulating method that virtual starting is intelligently repaired |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101414277A (en) * | 2008-11-06 | 2009-04-22 | 清华大学 | Need-based increment recovery disaster-containing system and method based on virtual machine |
| CN101546364A (en) * | 2008-12-29 | 2009-09-30 | 厦门市美亚柏科资讯科技有限公司 | Method and system for performing automatic intelligent forensics on storage medium |
| CN101645048A (en) * | 2009-08-27 | 2010-02-10 | 公安部第三研究所 | Method for realizing computer virtualized evidence obtaining |
| US20100115506A1 (en) * | 2006-12-11 | 2010-05-06 | Ljungbjoern Rune | Method and arrangement for software dependency resolution |
-
2012
- 2012-11-23 CN CN201210485194.XA patent/CN103092672B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100115506A1 (en) * | 2006-12-11 | 2010-05-06 | Ljungbjoern Rune | Method and arrangement for software dependency resolution |
| CN101414277A (en) * | 2008-11-06 | 2009-04-22 | 清华大学 | Need-based increment recovery disaster-containing system and method based on virtual machine |
| CN101546364A (en) * | 2008-12-29 | 2009-09-30 | 厦门市美亚柏科资讯科技有限公司 | Method and system for performing automatic intelligent forensics on storage medium |
| CN101645048A (en) * | 2009-08-27 | 2010-02-10 | 公安部第三研究所 | Method for realizing computer virtualized evidence obtaining |
Non-Patent Citations (2)
| Title |
|---|
| 仿真分析取证模型的形式化研究;张羽，吴瑞;《福建警察学院学报》;20100215;全文 * |
| 构建我国计算机仿真取证标准的思考;王俊;《中国司法鉴定》;20100515;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103092672A (en) | 2013-05-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104468226B (en) | Collocation method and device based on Nginx | |
| CN103235725A (en) | Linux-based rapid deployment method for Oracle database in cloud computing | |
| CN103927484A (en) | Malicious program behavior capture method based on Qemu | |
| CN107632937B (en) | Method and device for testing virtual machine cluster and readable storage medium | |
| CN103744759A (en) | Method for verifying unattended disk performance and stability under Linux system | |
| JP2010527056A (en) | Virtual machine migration | |
| CN104360892A (en) | System and method for creating virtual machine | |
| CN105843682A (en) | Method and apparatus for migrating virtual machine to IaaS cloud platform | |
| CN106406979A (en) | Method of migrating virtual machine of XenServer platform to KVM virtual platform | |
| CN104281808A (en) | Universal detection method for malicious act of Android system | |
| CN103677880A (en) | Information processing method and electronic equipment | |
| CN103092672B (en) | A kind of virtual computer dynamic stimulating method starting intelligence and repair | |
| CN106201657A (en) | A kind of network interface card information processing method based on virtual machine and device | |
| CN102289513A (en) | Method and system for obtaining internal files of virtual machine | |
| CN110007941A (en) | A kind of the MCU firmware and upgrade method of Intelligent refuse classification recovery system | |
| CN106294387A (en) | Data migration method and device | |
| CN104699615A (en) | System failure processing method and device | |
| CN103389905A (en) | Plug-in loading method and plug-in loading system | |
| CN103207817A (en) | Automatic reduction method for virtual machine | |
| CN105653342A (en) | Method and system for achieving automatic domain entering of Windows pool desktop | |
| CN103077261B (en) | A kind of computer dynamic stimulating method that virtual environment intelligence is repaired | |
| CN102096782A (en) | Internet banking safety authentication method based on removable medium of virtual machine | |
| CN103823750A (en) | Cloud-based software test service method | |
| CN103559574A (en) | Method and system for operating workflow | |
| US10628147B2 (en) | Detach virtual machine from virtual machine template |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CP03 | Change of name, title or address | ||
| CP03 | Change of name, title or address |
Address after: 361000, No. 6, building 3, No. 2599 West Coast Road, Tongan District, Fujian, Xiamen Patentee after: Xiamen Sino US Min Min Technology Co., Ltd. Address before: Haicang District of Xiamen City, Fujian province 361000 Xinyang Street Weng Kok Road No. 289 building 4 unit 07 branch Patentee before: Xiamen Meiya Zhongmin Electronic Technology Co., Ltd. |