Current network forensics systems are static and not real-time.In order to overcome the shortages

a new forensics model based on artificial immune theory and multi-agent theory is introduced here.Comparing with traditional computer forensics methods

the new method combines the advantages of a Intrusion Detect System based on immunology and a distributed system organized as Multi-Agent system.It provides the capacity that gathering real-time evidence dynamically as soon as network intrusions take place and saving the evidence in a safe way to prepare for the collection and analysis of the original data.In this paper

architecture of the model and the definitions of its components are given out.The experiment shows that it is able to insure the authenticity

integrality and validity of the digital evidence

and it is a new method for dynamic computer forensics.