Considering on judicial forensic requirements and the characteristic of network packets

a network dynamic forensic model is proposed

which architecture and related rules are described.An algorithm based two-dimensional linked list and multi-queue which is used to cache network data in high speed network is designed.The effectiveness of the algorithm is analyzed and tested.The algorithm resolves key problem in the above model and ensures the integrality of network session which is saved.Finally

a network forensic system is designed by plug-in

which is extensible and support second development.