本文就如何获取攻击计算机系统的计算机证据，提出一种切实可行的有效方法，这就是通过计算机审计系统，监视并记录计算机系统的活动，当计算机系统受到攻击时，这些记录就成为有力的计算机证据。文中首先阐述了计算机证据的特征以及运用计算机审计技术的必要性，然后给出了一种计算机审计系统的设计思想。 This paper presents a practical and effective method of obtaining computer evidence of attacks on computer systems by monitoring and recording the activities of computer systems through computerized auditing systems. These records become powerful computer evidence when computer systems are attacked . First of all, the paper expounds the characteristics of computer evidence and the necessity of using computer audit techniques, and then gives a design idea of ​​computer audit system.