Forensic memory evidence of Windows application

Tools

Olajide, F. ORCID: 0000-0003-1627-6637, Savage, N., Akmayeva, G. and Trafford, R., 2013. Forensic memory evidence of Windows application. In: Proceedings of the 2012 International Conference for Internet Technology and Secured Transactions (ICITST-2012). Piscataway, NJ: Institute of Electrical and Electronics Engineers (IEEE), pp. 715-718. ISBN 9781467353250

Preview

Text
1597822_Olajide.pdf - Published version
Download (205kB) | Preview

Abstract

In modern digital investigations, forensic sensitive information can be gathered from the physical memory of computer systems. Digital forensic community feels the urge towards accurate data collection, preservation, examination, validation, data analysis and presentation. This investigative process has become an essential part of digital investigation. The extraction of forensically relevant evidence from the physical memory can reveals users' actions. This research will report the amount of evidence that can be extracted and how the evidence changes with the length of time that the system is switched on and the application is still opened. In this experiment, the quantitative assessment of user input on the most commonly used applications will be presented.

Item Type:

Chapter in book

Description:

Paper presented at the 2012 International Conference for Internet Technology and Secured Transactions (ICITST-2012), London, 10-12 December 2012.

Creators:

Olajide, F., Savage, N., Akmayeva, G. and Trafford, R.

Publisher:

Institute of Electrical and Electronics Engineers (IEEE)

Place of Publication:

Piscataway, NJ

Date:

2013