在电子取证过程中,电子邮件已经成为一个重要证据来源[1]。然而长久以来存在一个被忽略的部分,即检查分析垃圾邮件。垃圾邮件内容被广泛认为不包含证据、无关联信息。如果犯罪嫌疑人以这一途径传递消息,那么忽略对它的检查,最终有可能导致在取证调查的过程中错失获得重要证据的机会。国内外针对电子邮件的取证技术的研究尚不 In the process of electronic forensics, e-mail has become an important source of evidence [1]. However, there has long been a neglected part of checking and analyzing spam. Spam content is widely considered to contain no evidence, no associated information. If the suspect passes the message in this way, neglecting its inspection may eventually lead to a missed opportunity to obtain important evidence during the forensic investigation. At home and abroad for e-mail forensic technology research is not yet