A dynamic computer forensics method based on honeypot is presented in this paper.This method can transfer the intrusion to a virtual entironments with honeypot.It can not only protect the network or host

but also gain the more time for gathering evidence

so that the more authentic evidence can be achieved.Experimental result shows that the system remains higher detection rate and lower false alarm rate and better forensics ability.