File Download
  Links for fulltext
     (May Require Subscription)
Supplementary

Conference Paper: Memory acquisition: A 2-Take approach

TitleMemory acquisition: A 2-Take approach
Authors
KeywordsLive forensics
Memory acquisition
Memory forensics
Issue Date2009
PublisherIEEE.
Citation
The 2009 International Workshop on Forensics for Future Generation Communication Environments (F2GC-09) in conjunction with CSA 2009, Jeju Island, Korea, 10-12 December 2009. In Proceedings of CSA, 2009, p. 1-4 How to Cite?
AbstractWhen more and more people recognize the value of volatile data, live forensics gains more weight in digital forensics. It is often used in parallel with traditional pull-the-plug forensics to provide a more reliable result in forensic examination. One of the core components in live forensics is the collection and analysis of memory volatile data, during which the memory content is acquired for searching of relevant evidential data or investigating various computer processes to unveil the activities being performed by a user. However, this conventional method may have weaknesses because of the volatile nature of memory data and the absence of original data for validation. This may cause implication to the admissibility of memory data at the court of law which requires strict authenticity and reliability of evidence. In this paper, we discuss the impact of various memory acquisition methods and suggest a 2-Take approach which aims to enhance the confidence level of the acquired memory data for legal proceedings. © 2009 IEEE.
Persistent Identifierhttp://hdl.handle.net/10722/125702
ISBN
References

 

DC FieldValueLanguage
dc.contributor.authorLaw, FYWen_HK
dc.contributor.authorLai, PKYen_HK
dc.contributor.authorChow, KPen_HK
dc.contributor.authorIeong, RSCen_HK
dc.contributor.authorKwan, MYKen_HK
dc.contributor.authorTse, KWHen_HK
dc.contributor.authorTse, HKSen_HK
dc.date.accessioned2010-10-31T11:46:57Z-
dc.date.available2010-10-31T11:46:57Z-
dc.date.issued2009en_HK
dc.identifier.citationThe 2009 International Workshop on Forensics for Future Generation Communication Environments (F2GC-09) in conjunction with CSA 2009, Jeju Island, Korea, 10-12 December 2009. In Proceedings of CSA, 2009, p. 1-4en_HK
dc.identifier.isbn978-1-4244-4946-0-
dc.identifier.urihttp://hdl.handle.net/10722/125702-
dc.description.abstractWhen more and more people recognize the value of volatile data, live forensics gains more weight in digital forensics. It is often used in parallel with traditional pull-the-plug forensics to provide a more reliable result in forensic examination. One of the core components in live forensics is the collection and analysis of memory volatile data, during which the memory content is acquired for searching of relevant evidential data or investigating various computer processes to unveil the activities being performed by a user. However, this conventional method may have weaknesses because of the volatile nature of memory data and the absence of original data for validation. This may cause implication to the admissibility of memory data at the court of law which requires strict authenticity and reliability of evidence. In this paper, we discuss the impact of various memory acquisition methods and suggest a 2-Take approach which aims to enhance the confidence level of the acquired memory data for legal proceedings. © 2009 IEEE.en_HK
dc.languageengen_HK
dc.publisherIEEE.-
dc.relation.ispartofProceedings of the International Conference on Computer Science and Its Applications, CSA 2009en_HK
dc.rightsProceedings of the International Conference on Computer Science and Its Applications. Copyright © IEEE.-
dc.rightsCreative Commons: Attribution 3.0 Hong Kong License-
dc.rights©2010 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.-
dc.subjectLive forensicsen_HK
dc.subjectMemory acquisitionen_HK
dc.subjectMemory forensicsen_HK
dc.titleMemory acquisition: A 2-Take approachen_HK
dc.typeConference_Paperen_HK
dc.identifier.emailChow, KP:chow@cs.hku.hken_HK
dc.identifier.authorityChow, KP=rp00111en_HK
dc.description.naturepublished_or_final_version-
dc.identifier.doi10.1109/CSA.2009.5404199en_HK
dc.identifier.scopuseid_2-s2.0-80655130272en_HK
dc.identifier.hkuros182209en_HK
dc.relation.referenceshttp://www.scopus.com/mlt/select.url?eid=2-s2.0-80655130272&selection=ref&src=s&origin=recordpageen_HK
dc.identifier.spage1-
dc.identifier.epage4-
dc.description.otherThe 2009 International Workshop on Forensics for Future Generation Communication Environments (F2GC-09) in conjunction with CSA 2009, Jeju Island, Korea, 10-12 December 2009. In Proceedings of CSA, 2009, p. 1-4-
dc.identifier.scopusauthoridLaw, FYW=19640490000en_HK
dc.identifier.scopusauthoridLai, PKY=19640260600en_HK
dc.identifier.scopusauthoridChow, KP=7202180751en_HK
dc.identifier.scopusauthoridIeong, RSC=22734240200en_HK
dc.identifier.scopusauthoridKwan, MYK=19640239200en_HK
dc.identifier.scopusauthoridTse, KWH=54382354800en_HK
dc.identifier.scopusauthoridTse, HKS=36844822700en_HK

Export via OAI-PMH Interface in XML Formats


OR


Export to Other Non-XML Formats