Journal
DIGITAL INVESTIGATION
Volume 6, Issue -, Pages S121-S131Publisher
ELSEVIER SCI LTD
DOI: 10.1016/j.diin.2009.06.003
Keywords
Computer forensics; Digital investigation; Windows memory; Sensitive information; Application fingerprint; Memory analysis; Stack analysis; String matching
Ask authors/readers for more resources
Forensic analysis of physical memory is gaining good attention from experts in the community especially after recent development of valuable tools and techniques. Investigators find it very helpful to seize physical memory contents and perform post-incident analysis of this potential evidence. Most of the research carried out focus on enumerating processes and threads by accessing memory resident objects. To collect case-sensitive information from the extracted memory content, the existing techniques usually rely on string matching. The most important contribution of the paper is a new technique for extracting sensitive information from physical memory. The technique is based on analyzing the call stack and the security sensitive APIs. It allows extracting sensitive information that cannot be extracted by string matching-based techniques. In addition, the paper leverages string matching to get a more reliable technique for analyzing and extracting what we called application/protocol fingerprints''. The proposed techniques and their implementation target the machines running under the Windows XP (SP1, SP2) operating system. (C) 2009 Digital Forensic Research Workshop. Published by Elsevier Ltd. All rights reserved.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available