Conference Paper: Identifying volatile data from multiple memory dumps in live forensics

File Download Links for fulltext
(May Require Subscription)
Supplementary

  • Basic View
  • Metadata View
  • XML View
TitleIdentifying volatile data from multiple memory dumps in live forensics
AuthorsLaw, F
Chan, P
Yiu, SM
Tang, B
Lai, P
Chow, KP
Ieong, R
Kwan, M
Hon, WK1
Hui, L
KeywordsLive Forensics
Memory Analysis
Volatile Data
Issue Date2010
CitationIfip Advances In Information And Communication Technology, 2010, v. 337 AICT, p. 185-194 [How to Cite?]
DOI: http://dx.doi.org/10.1007/978-3-642-15506-2_13
AbstractOne of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages. © 2010 International Federation for Information Processing.
ISSN1868-4238
2011 SCImago Journal Rankings: 0.028
DOIhttp://dx.doi.org/10.1007/978-3-642-15506-2_13
ReferencesReferences in Scopus
DC Field
Value
dc.contributor.authorLaw, F
dc.contributor.authorChan, P
dc.contributor.authorYiu, SM
dc.contributor.authorTang, B
dc.contributor.authorLai, P
dc.contributor.authorChow, KP
dc.contributor.authorIeong, R
dc.contributor.authorKwan, M
dc.contributor.authorHon, WK
dc.contributor.authorHui, L
dc.date.accessioned2012-06-26T06:32:10Z
dc.date.available2012-06-26T06:32:10Z
dc.date.issued2010
dc.description.abstractOne of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages. © 2010 International Federation for Information Processing.
dc.description.natureLink_to_subscribed_fulltext
dc.identifier.citationIfip Advances In Information And Communication Technology, 2010, v. 337 AICT, p. 185-194 [How to Cite?]
DOI: http://dx.doi.org/10.1007/978-3-642-15506-2_13
dc.identifier.doihttp://dx.doi.org/10.1007/978-3-642-15506-2_13
dc.identifier.epage194
dc.identifier.issn1868-4238
2011 SCImago Journal Rankings: 0.028
dc.identifier.scopuseid_2-s2.0-78651108753
dc.identifier.spage185
dc.identifier.urihttp://hdl.handle.net/10722/151988
dc.identifier.volume337 AICT
dc.languageeng
dc.relation.ispartofIFIP Advances in Information and Communication Technology
dc.relation.referencesReferences in Scopus
dc.subjectLive Forensics
dc.subjectMemory Analysis
dc.subjectVolatile Data
dc.titleIdentifying volatile data from multiple memory dumps in live forensics
dc.typeConference_Paper
Author Affiliations
  1. National Tsing Hua University