No abstract

In this paper we discuss how operating system design and implementation influences the methodology for computer forensics investigations, with the focus on forensic acquisition of memory. In theory the operating system could support such investigations both in terms of tools for analysis of data and by making the system data readily accessible for analysis. Conventional operating systems such as Windows and UNIX derivatives offer some memory-related tools that are geared towards the analysis of system crashes, rather than forensic investigations. In this paper we demonstrate how techniques developed for persistent operating systems, where lifetime of data is independent of the method of its creation and storage, could support computer forensics investigations delivering higher efficiency and accuracy. It is proposed that some of the features offered by persistent systems could be built into conventional operating systems to make illicit activities easier to identify and analyse. We further propose a new technique for forensically sound acquisition of memory based on the persistence paradigm.

No abstract

No abstract

No abstract

Computer forensics is a multidisciplinary field concerned with the examination of computer systems which have been involved in criminal activity, either as an object or a tool of a crime. The aim of the investigator is to find information relevant to the case in question, as well as the chain of events leading to the creation of this information. In other words the questions to be answered are "What incriminating information is present in the system?" and "How did the incriminating information get there?"

No abstract

No abstract