Abstract: A dynamic computer forensics method based on honeypot is presented in this paper.This method can transfer the intrusion to a virtual entironments with honeypot.It can not only protect the network or host, but also gain the more time for gathering evidence, so that the more authentic evidence can be achieved.Experimental result shows that the system remains higher detection rate and lower false alarm rate and better forensics ability.