blocks|key|442602|text|是的，你可以用Java来完成所有的工作，如果有一些事情必须用C来完成，你可以通过JNI包来调用“危险”的例程。Java赋予你健壮性，安全模型，可伸缩性不是大问题……你不必应付64位操作系统，或者优化你的代码以利用多个CPU-s，你会发现这很奇怪，但这是真的:你的软件在Java中可能比在C中运行得更快。如果你不是一般的开发人员，如果你熟悉CPU的结构，对机器代码和寄存器的处理了如指掌，那么就忘了我的文章吧，你可能会在C中做得更好。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|442603|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

yes, you can do it all in Java, if there are something that must be done in C , you have JNI package through which you can call 'dangerous' routines. Java grants you robustness, security model,scalability is not big issue... you don't have to cope with 64 bit OS, or optimizing your code to take advantage of multiples CPU-s, you will find it odd but true: your software might run faster in Java than in C. If you are not average developer, if you are familiar with CPU structure, understand machine code and handling with registers thorughly, then forget my text, you might have it done better in C.

blocks|key|822012|text|出于以下原因，我们一直在将取证代码从C%2B%2B和Python迁移到Java：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|822013|822014|我们担心损坏的数据会如何影响我们的工具；对于Java，这不是什么大问题。|unordered-list-item|822015|Single+Java+binary将在32位和64位系统上运行|822016|更好地利用线程。|822017|822018|我们的初步结果非常有希望:从C%2B%2B移植到Java的bulk_extractor运行速度快了3倍！我们都很惊讶。我们认为这是因为jflex比flex产生更快的FSM。|822019|主要问题是没有很好的开源Java取证文件系统，也没有针对SleuthKit的JNI绑定。我们的一个变通方法是使用fiwalk从磁盘映像中提取所有元数据到XML+blob中，然后在java中处理XML。|822020|要下载这些工具，请查看http://afflib.org/|offset|length|822021|entityMap|0|LINK|mutability|MUTABLE|url|http://afflib.org/^0|0|0|0|0|0|0|0|0|B|I|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|11|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|12|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|13|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|14|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|15|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|16|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|17|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|18|8|@]|9|@$Q|19|R|1A|1|1B]]|A|$]]|$1|S|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z]]]]

We have been moving our forensics code from C++ and Python to Java for the following reasons:

<ul>
<li>We are concerned about how corrupt data may impact our tools; with Java it is less of an issue.</li>
<li>Single Java binary will run on 32bit and 64bit systems</li>
<li>Better exploitation of threads.</li>
</ul>

Our initial results are quite promising: bulk_extractor ported from C++ to Java ran 3x faster! We were amazed. We think that this is because jflex produces a faster FSM than flex.

The main problem is that there are no good open source Java forensic file systems, and there are no JNI bindings for SleuthKit. One of our workarounds is to extract all of the metadata from a disk image using fiwalk into an XML blob and then process the XML in java.

To download these tools, check out <a href="http://afflib.org/" rel="nofollow noreferrer">http://afflib.org/</a>

blocks|key|2759012|text|在Java中，处理二进制解析和任意字符串解析是非常痛苦的，而且完全没有必要。Java缺少无符号整数也很烦人。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2759013|我们将python用于内部的一切，因为它的编码很简单(特别是与java的庞大相比)，struct.pack/unpack使得二进制数据的解析变得简单，内置的数据结构/对象，以及它们几乎是我们所需的一切的库。|2759014|我真的不能推荐使用Java进行取证处理|2759015|编辑：|2759016|此外，许多取证工具要么已经在python中，要么具有python绑定(易失性、侦探工具包等)。|2759017|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

Dealing with binary parsing and arbitrary string parsing is really painful in Java and quite unnecessary. Java's lack of unsigned integer is really annoying as well.

We use python for everything in house as its trivial to code (especially compared to the bulkiness of java), struct.pack/unpack makes parsing of binary data simple, the built in data structures / objects, and the fact that they are libraries for nearly everything we need

I really couldn't recommend Java for forensics processing

edit:

also a number of forensics tools are either already in python or have python bindings (volatility, sleuthkit, etc)

blocks|key|822087|text|Sleuth+Kit现在具有JNI绑定。它们没有正式发布，但你可以在github主分支上找到它们。SQLite数据库由带有文件系统元数据的C%2B%2B代码填充，然后Java代码查询数据库并生成相应的Java对象。JNI用于将文件内容放入Java端。Autopsy+3(这是一个Java应用程序)使用绑定。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|822088|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The Sleuth Kit now has JNI bindings. They are not officially released, but you can find them on the github master branch. A SQLite database is populated by the C++ code with file system metadata and then Java code queries the database and makes corresponding Java objects. JNI is used to get the file content into the Java side. Autopsy 3 (which is a Java NetBeans RCP app) uses the bindings.

Just wondering if anyone out there has any experiance working with java (as appose to c/c++) in a digital forensics environment and if so could they advise me as to problems or advantages they may have encountered? 
Cheers

Java as a digital forensics environment

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我想知道是否有人有在数字取证环境中使用java (相对于c/c++)的经验，如果有，他们能告诉我他们可能遇到的问题或优点吗？干杯

问作为数字取证环境的Java
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问作为数字取证环境的JavaEN