Enhancement of Forensic Computing Investigations through Memory Forensic Techniques

Abstract

The use of memory forensic techniques has the potential to enhance computer forensic investigations. The analysis of digital evidence is facing several key challenges; an increase in electronic devices, network connections and bandwidth, the use of anti-forensic technologies and the development of network centric applications and technologies has lead to less potential evidence stored on static media and increased amounts of data stored off-system. Memory forensic techniques have the potential to overcome these issues in forensic analysis. While much of the current research in memory forensics has been focused on low-level data, there is a need for research to extract high-level data from physical memory as a means of providing forensic investigators with greater insight into a target system. This paper outlines the need for further research into memory forensic techniques. In particular it stresses the need for methods and techniques for understanding context on a system and also as a means of augmenting other data sources to provide a more complete and efficient searching of investigations.

Analysis of Privacy of Private Browsing Mode through Memory Forensics

“…A theoretical discussion of RAM forensics tools, techniques and guidelines can be found in [4], [16] and [2]. The authors provide a comprehensive discussion of the way physical memory works in Windows and Linux operating systems as well as the types of data that can be extracted from physical memory.…”

Live memory forensics of mobile phones

“…In addition, techniques to protect the privacy of users and confidentiality of user data, such as encryption and password protection, have also indirectly provided counter forensics means to technologically aware criminals. Therefore, conventional forensic methods are no longer adequate and more research efforts have been placed in live memory forensic analysis of computer systems (Carrier and Grand, 2004;Adelstein, 2006;Petroni et al, 2006;Schatz, 2007;Kiley et al, 2008;Simon and Slay, 2009) in recent years to complement or enhance the former methods.…”

Memory dump and forensic analysis based on virtual machine

“…Because memory contains a large number of computer operation information, such as running process, loading module and link library, user name and password, email address and web site, each process open files, etc [9][10][11][12][13][14][15][16][17][18][19]. Memory forensics is particularly important, because the system of physical memory contains lots of useful information, such as running process, when created, by whom created and the process have what special activities, the status of the system network, the user information, etc.…”