File Download
 
Links for fulltext
(May Require Subscription)
 
Supplementary

Conference Paper: Identifying volatile data from multiple memory dumps in live forensics
  • Basic View
  • Metadata View
  • XML View
TitleIdentifying volatile data from multiple memory dumps in live forensics
 
AuthorsLaw, F
Chan, P
Yiu, SM
Tang, B
Lai, P
Chow, KP
Ieong, R
Kwan, M
Hon, WK1
Hui, L
 
KeywordsLive Forensics
Memory Analysis
Volatile Data
 
Issue Date2010
 
CitationIfip Advances In Information And Communication Technology, 2010, v. 337 AICT, p. 185-194 [How to Cite?]
DOI: http://dx.doi.org/10.1007/978-3-642-15506-2_13
 
AbstractOne of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages. © 2010 International Federation for Information Processing.
 
ISSN1868-4238
2013 SCImago Journal Rankings: 0.186
 
DOIhttp://dx.doi.org/10.1007/978-3-642-15506-2_13
 
ReferencesReferences in Scopus
 
DC FieldValue
dc.contributor.authorLaw, F
 
dc.contributor.authorChan, P
 
dc.contributor.authorYiu, SM
 
dc.contributor.authorTang, B
 
dc.contributor.authorLai, P
 
dc.contributor.authorChow, KP
 
dc.contributor.authorIeong, R
 
dc.contributor.authorKwan, M
 
dc.contributor.authorHon, WK
 
dc.contributor.authorHui, L
 
dc.date.accessioned2012-06-26T06:32:10Z
 
dc.date.available2012-06-26T06:32:10Z
 
dc.date.issued2010
 
dc.description.abstractOne of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages. © 2010 International Federation for Information Processing.
 
dc.description.naturelink_to_subscribed_fulltext
 
dc.identifier.citationIfip Advances In Information And Communication Technology, 2010, v. 337 AICT, p. 185-194 [How to Cite?]
DOI: http://dx.doi.org/10.1007/978-3-642-15506-2_13
 
dc.identifier.doihttp://dx.doi.org/10.1007/978-3-642-15506-2_13
 
dc.identifier.epage194
 
dc.identifier.issn1868-4238
2013 SCImago Journal Rankings: 0.186
 
dc.identifier.scopuseid_2-s2.0-78651108753
 
dc.identifier.spage185
 
dc.identifier.urihttp://hdl.handle.net/10722/151988
 
dc.identifier.volume337 AICT
 
dc.languageeng
 
dc.relation.ispartofIFIP Advances in Information and Communication Technology
 
dc.relation.referencesReferences in Scopus
 
dc.subjectLive Forensics
 
dc.subjectMemory Analysis
 
dc.subjectVolatile Data
 
dc.titleIdentifying volatile data from multiple memory dumps in live forensics
 
dc.typeConference_Paper
 
<?xml encoding="utf-8" version="1.0"?>
<item><contributor.author>Law, F</contributor.author>
<contributor.author>Chan, P</contributor.author>
<contributor.author>Yiu, SM</contributor.author>
<contributor.author>Tang, B</contributor.author>
<contributor.author>Lai, P</contributor.author>
<contributor.author>Chow, KP</contributor.author>
<contributor.author>Ieong, R</contributor.author>
<contributor.author>Kwan, M</contributor.author>
<contributor.author>Hon, WK</contributor.author>
<contributor.author>Hui, L</contributor.author>
<date.accessioned>2012-06-26T06:32:10Z</date.accessioned>
<date.available>2012-06-26T06:32:10Z</date.available>
<date.issued>2010</date.issued>
<identifier.citation>Ifip Advances In Information And Communication Technology, 2010, v. 337 AICT, p. 185-194</identifier.citation>
<identifier.issn>1868-4238</identifier.issn>
<identifier.uri>http://hdl.handle.net/10722/151988</identifier.uri>
<description.abstract>One of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages. &#169; 2010 International Federation for Information Processing.</description.abstract>
<language>eng</language>
<relation.ispartof>IFIP Advances in Information and Communication Technology</relation.ispartof>
<subject>Live Forensics</subject>
<subject>Memory Analysis</subject>
<subject>Volatile Data</subject>
<title>Identifying volatile data from multiple memory dumps in live forensics</title>
<type>Conference_Paper</type>
<description.nature>link_to_subscribed_fulltext</description.nature>
<identifier.doi>10.1007/978-3-642-15506-2_13</identifier.doi>
<identifier.scopus>eid_2-s2.0-78651108753</identifier.scopus>
<relation.references>http://www.scopus.com/mlt/select.url?eid=2-s2.0-78651108753&amp;selection=ref&amp;src=s&amp;origin=recordpage</relation.references>
<identifier.volume>337 AICT</identifier.volume>
<identifier.spage>185</identifier.spage>
<identifier.epage>194</identifier.epage>
</item>
Author Affiliations
  1. National Tsing Hua University