Electronic evidence collection and analysis based on UNIX system

The UNIX system is widely used in important application server or network serve based on its reliability. It can reduce the amount of inspection data and dig valid evidence fast in the process of computer forensics by researching the techniques and principles of the evidence collection and analysis which based on UNIX system. At present, the electronic evidence has been included into the legislative types of evidence in the new litigation legislation of China, which due to the reality that it plays an increasingly important role in the process of the fact-finding of the case. And it is necessary to explore this issue, so as to improve the efficiency of computer forensic analysis in the process of evidence collection and analysis, and respond to the needs of the judicial practice.