Towards the Memory Forensics of MS Word Documents

Al-Sharif, Ziad A.; Bağcı, Hasan; Zaitoun, Toqa' Abu; Asad, Aseel

doi:10.1007/978-3-319-54978-1_25

Cited by 8 publications

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In respect to MS Word documents, various digital evidences can be recovered from memory. Al-Sharif et al [21] developed a memory forensic technique based on the XML form utilized by MS Office internally. Different parts of MS Word can be recovered from memory to establish that the document was seen or modified by the user, according to their findings.…”

Section: Literature Reviewmentioning

confidence: 99%

Windows 10's Browser Forensic Analysis for Tracing P2P Networks’ Anonymous Attacks

Kauser¹,

Malik²,

Hasan³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

A web browser is the most basic tool for accessing the internet from any of the machines/equipment. Recently, data breaches have been reported frequently from users who are concerned about their personal information, as well as threats from criminal actors. Giving loss of data and information to an innocent user comes under the jurisdiction of cyber-attack. These kinds of cyber-attacks are far more dangerous when it comes to the many types of devices employed in an internet of things (IoT) environment. Continuous surveillance of IoT devices and forensic tools are required to overcome the issues pertaining to secure data and assets. Peer to peer (P2P) applications have been utilized for criminal operations on the web. Therefore, it is a challenge for a forensic investigator to perform forensic analysis of the evolving hardware and software platforms for IoT. For identity concealment and privacy protection, the Onion Router (Tor) and Chrome with the Invisible Internet Project (I2P) as the foundation browser are often used. Confirmation is required to determine whether Tor is truly anonymous and private as they claim. Some people, on the other hand, utilize the Tor browser for evil reasons. Tools and techniques are available for the collection of artifacts, identifying problem areas, further processing and analysis of data on the computer and IoT. Present research tried to explore a few tools for the tracing of I2P activities over computer on windows 10 that reflects IoT devices. According to the results of this research, it leaves an excessive amount of important digital evidence on the operating system that can be exploited to attack the information of users. This research is based on windows operating system and does not support other operating systems.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Windows 10's Browser Forensic Analysis for Tracing P2P Networks’ Anonymous Attacks

Kauser¹,

Malik²,

Hasan³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Therefore, RAM image acquisition software runs at the kernel mode level. There exist open source and commercial software that acquires RAM images for the Windows operating system [2][3][4]. The RAM images acquired by these software packages are used in RAM analysis and data carving operations.…”

Section: Introductionmentioning

confidence: 99%

Analysing and Carving MS Word and PDF Files from RAM Images on Windows

2022

Teh. vjesn.

View full text Add to dashboard Cite

In this study, a piece of software has been developed to recover the readable data by carving MS Word and PDF files from the RAM image. String searching, signature scanning, and data carving methods are used in the design of the software. The analysis was performed on a RAM image of 14 GB by using the software that was developed. The success rate for each file was determined by comparing the recovered data to the data in the original file. It was determined that the rate of data recovery decreases as the size of the MS Word or PDF files loaded onto RAM increases. Consequently, it is aimed to be an important example of obtaining electronic evidence from volatile data in forensic informatics with the proposed study.

show abstract