The Research on Email Forensic Based Network

According to requirement of judicial forensic and diversity of network crime, a framework based on XML and plug-in techniques is proposed. The framework uses plug-in technique which ensures the framework has good extensibility; meanwhile, the framework adopts encrypt and authentication technology which ensures collected evidence can be accepted by court. Subsequently, based on this framework, an algorithm on email forensic is proposed, and by means of fuzzy matching the algorithm can analysis email information from network packets on SMTP protocol and HTTP protocol.