電腦犯罪與資訊安全事件發生件數的成長，使得企業或電腦使用者不得不正視此一問題。但常因為證據資料的刪除，而無法發現事件的發生；另外，就目前的電腦鑑識研究而言，雖然可以處理大多電腦犯罪事件，但是，對於技術高深的入侵者而言，要刪除證據資料且無法回復並非不可能做到。 本文之『不信任區域網路』，乃相對於Bruce Schneier所提出之網路上具有可信任之主機而言，故本研究之前提乃視所有於區域上之主機皆不可信，傳遞之資料皆須進行保護。 利用簡單的「公開加密機制」與具機密性和完整性的「分散式容錯機制」，建立具完整性、鑑別性、可用性及彈性的數位證據保留架構，有效地將可證明不法事件事實的數位資料，轉換成具（n?m）容錯比例與企業內部亦無從竄改之數位證據。 並於上述架構中加入檢查機制，將原須約檢查[n/2]次（假設共有n筆資料）方可找出資料關鍵處的檢查方法，有效的減為約檢查[(2+n)/8]+2次，便可達到。 此架構的建置可同時確保公司內、外部犯罪證據之安全性，並經網路模擬器實驗模擬，該架構可於區域網路上建置，不至於造成網路癱瘓。 By the rate of the information secirty events and computer crimes happened increasing, the business and computer users must face up to the problem. Because the high volatility of digital evidence, the illegal user do not usually cover up the happened event but also hide the actions what they do. The research focuses on how to storage the digital evidence and keep the admissibility and weight of the digital evidence at the same time. The word “untrusted LAN” is oppsited to the Bruce Schneier’s “Trusted Machine”, means no trusted machines in the LAN, therefore any evidence that will be storaged must be protected or it will be broken. After studying the Secure Log, Cryptography, and Fault Tolerance domains, we provide a solution, “ The framework of Keeping Digital Evidence”. The flexible framework can transfer important data about the illegal event to the digital enidence that cannot be modify and has n/m fault tolerance rate. Then we design a checking function, it can decrease the mean of check times from [n/2] to [(2+n)/8]+2. Finally we use the Network Simulator 2 program to simulate our framework in LAN, to valid the framework can implement in LAN without crashing the network traffic.
