Abstract: E-forensics knowledge is reflected by performer wisdom during forensic performance, while it is always disappeared in individual case on actual performance. By making forensics knowledge standard, upgrading forensics software, remodeling forensics equipment, converging and processing forensics knowledge, these method can produce various forensics knowledge bases and share with performers by network mechanism. It will change the original state that forensics ability is completely relied on personal ability, promote the integration of personal ability and collective wisdom. Meanwhile, the mechanism will build up forensics knowledge ecology, promote positive cycle of forensics technology and bring qualitative leap for forensics performance.

Key words: E-forensics, forensics knowledge, knowledge converging, forensics knowledge base, knowledge sharing

摘要： 电子数据取证知识是工作人员智慧在取证过程中的体现，然而实际工作中它一直消失在个案中.通过制定取证知识标准，升级取证软件，改造取证装备，将取证知识汇聚及加工处理形成各种取证知识库，并通过网络机制分享给工作人员.这将原来的取证能力完全依赖个人能力提升到个人能力与集体智慧的结合.同时这种机制也将建立起取证知识生态，促进取证技术的良性循环，为取证工作带来质的飞跃.

关键词: 电子取证, 取证知识, 知识汇聚, 取证知识库, 知识共享