A TOOL FOR EXTRACTING STATIC AND VOLATILE FORENSIC ARTIFACTS OF WINDOWS 8.x APPS

Abstract : Microsoft Windows 8 introduced lightweight sandboxed applications called “apps” that provide a full range of functionality on top of touchenabled displays. Apps offer a wide range of functionality, including media editing, file sharing, Internet surfing, cloud service usage, online social media activities and audio/video streaming for the Windows 8 and 8.1 operating systems. The use of these apps produces much more forensically-relevant information compared with conventional application programs. This chapter describes MetroExtractor, a tool that gathers static and volatile forensic artifacts produced by Windows apps. The volatile artifacts are extracted from the hibernation and swap files available on storage media. MetroExtractor creates a timeline of user activities and the associated data based on the collected artifacts. The tool appears to be the first implementation for extracting forensicallysound static and volatile Windows 8 app artifacts from a system hard disk.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 11th IFIP International Conference on Digital Forensics (DF), Jan 2015, Orlando, FL, United States. IFIP Advances in Information and Communication Technology, AICT-462, pp.305-320, 2015, Advances in Digital Forensics XI. 〈10.1007/978-3-319-24123-4_18〉
Liste complète des métadonnées

Littérature citée [17 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01449065
Contributeur : Hal Ifip <>
Soumis le : lundi 30 janvier 2017 - 09:13:31
Dernière modification le : vendredi 1 décembre 2017 - 01:16:44

Fichier

978-3-319-24123-4_18_Chapter.p...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Shariq Murtuza, Robin Verma, Jayaprakash Govindaraj, Gaurav Gupta. A TOOL FOR EXTRACTING STATIC AND VOLATILE FORENSIC ARTIFACTS OF WINDOWS 8.x APPS. Gilbert Peterson; Sujeet Shenoi. 11th IFIP International Conference on Digital Forensics (DF), Jan 2015, Orlando, FL, United States. IFIP Advances in Information and Communication Technology, AICT-462, pp.305-320, 2015, Advances in Digital Forensics XI. 〈10.1007/978-3-319-24123-4_18〉. 〈hal-01449065〉

Partager

Métriques

Consultations de la notice

142

Téléchargements de fichiers

38