A TOOL FOR EXTRACTING STATIC AND VOLATILE FORENSIC ARTIFACTS OF WINDOWS 8.x APPS

Abstract : Microsoft Windows 8 introduced lightweight sandboxed applications called “apps” that provide a full range of functionality on top of touchenabled displays. Apps offer a wide range of functionality, including media editing, file sharing, Internet surfing, cloud service usage, online social media activities and audio/video streaming for the Windows 8 and 8.1 operating systems. The use of these apps produces much more forensically-relevant information compared with conventional application programs. This chapter describes MetroExtractor, a tool that gathers static and volatile forensic artifacts produced by Windows apps. The volatile artifacts are extracted from the hibernation and swap files available on storage media. MetroExtractor creates a timeline of user activities and the associated data based on the collected artifacts. The tool appears to be the first implementation for extracting forensicallysound static and volatile Windows 8 app artifacts from a system hard disk.
Document type :
Conference papers
Complete list of metadatas

Cited literature [17 references]  Display  Hide  Download

https://hal.inria.fr/hal-01449065
Contributor : Hal Ifip <>
Submitted on : Monday, January 30, 2017 - 9:13:31 AM
Last modification on : Friday, December 1, 2017 - 1:16:44 AM

File

978-3-319-24123-4_18_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Shariq Murtuza, Robin Verma, Jayaprakash Govindaraj, Gaurav Gupta. A TOOL FOR EXTRACTING STATIC AND VOLATILE FORENSIC ARTIFACTS OF WINDOWS 8.x APPS. 11th IFIP International Conference on Digital Forensics (DF), Jan 2015, Orlando, FL, United States. pp.305-320, ⟨10.1007/978-3-319-24123-4_18⟩. ⟨hal-01449065⟩

Share

Metrics

Record views

201

Files downloads

413