Remote forensics system based on Minifilter

Remote forensics is one important development direction of modern computer forensics. Interception and filtering operations are the key technologies for remote forensics, and still facing technical challenges. This article will applied mini-filter installable file system (Minifilter) technology to the remote forensics, and propose a remote forensics system using Minifilter to intercept and filter operations and disk-level information hidden technology to ensure the precision of filtering operations and the safety of forensics information.