Abstract: In order to solve the problems existed in static forensics technology, this paper presents the design and implementation of a dynamic computer forensics system based on network. Compared with the traditional tools of the system, it performs the work of gathering evidence in advance before criminal action has occurred or in the process of crime so as to avoid the evidence chain lost caused by evidence not scout timely. It can improve the efficiency of the work of gathering evidence; enhance data integrity and timeliness of evidence. This paper describes the architecture, function and work flow, and the implementation of main functions of the core module technology.

Key words: computer forensics, electronic evidence, log, protocol analysis