伴随计算机的普及应用,记载信息的方式已逐渐从文字记录转为以日志、电子文件、电子表格、电子邮件等形式存储的数字信息。与此同时,数字复原技术和计算机取证活动也应运而生。一旦这些数据得以重现,其记载内容可被用于数据的复原、释明计算机历史操作记录,在法庭中用做证据证明案件事实,等等。在如何界定计算机记录的要领和计算机记录认证的研究方面,美国司法机构现已积累了许多经验,我国应借鉴美国的做法,实现计算机取证程序规范化,确定取证人员准入规范和日常考核规范,制定计算机取证的工具标准。 Accompanied by the popularization and application of computers, the way of recording information has gradually shifted from word records to digital information stored in the form of logs, electronic files, spreadsheets, e-mails and the like. In the meantime, digital restoration technologies and computer forensics activities have also emerged. Once these data are reproduced, the contents of the record can be used for the recovery of the data, the record of computer history operations, the evidence used in court to prove the facts of the case, and so forth. The judiciary in the United States has now accumulated a great deal of experience in how to define the essentials of computer records and the research on the certification of computer records. Our country should draw lessons from the United States to standardize the procedures of computer forensics and to determine the norms and daily assessment rules for forensic personnel. Computer forensics tool standards.