Identifying Volatile Data from Multiple Memory Dumps in Live Forensics

Abstract : One of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages.
Type de document :
Communication dans un congrès
Kam-Pui Chow; Sujeet Shenoi. 6th IFIP WG 11.9 International Conference on Digital Forensics (DF), Jan 2010, Hong Kong, China. Springer, IFIP Advances in Information and Communication Technology, AICT-337, pp.185-194, 2010, Advances in Digital Forensics VI. 〈10.1007/978-3-642-15506-2_13〉
Liste complète des métadonnées

Littérature citée [16 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01060618
Contributeur : Hal Ifip <>
Soumis le : mardi 28 novembre 2017 - 12:37:48
Dernière modification le : vendredi 29 décembre 2017 - 01:10:30

Fichier

LawCYTLCIKHH10.pdf
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Frank Law, Patrick Chan, Siu-Ming Yiu, Benjamin Tang, Pierre Lai, et al.. Identifying Volatile Data from Multiple Memory Dumps in Live Forensics. Kam-Pui Chow; Sujeet Shenoi. 6th IFIP WG 11.9 International Conference on Digital Forensics (DF), Jan 2010, Hong Kong, China. Springer, IFIP Advances in Information and Communication Technology, AICT-337, pp.185-194, 2010, Advances in Digital Forensics VI. 〈10.1007/978-3-642-15506-2_13〉. 〈hal-01060618〉

Partager

Métriques

Consultations de la notice

125

Téléchargements de fichiers

31