User data persistence in physical memory

Solomon, Jason M.; Huebner, Ewa; Bem, Derek; Szeynska, Magdalena

doi:10.1016/j.diin.2007.03.002

Cited by 24 publications

(11 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Research on the age of freed user process data in physical memory has shown that large segments of pages are unlikely to survive more than 5 min, even on a lightly loaded system (Solomona et al, 2007). However, smaller segments and single pages may be found up to 2 h after initial memory commit.…”

Section: Related Workmentioning

confidence: 99%

The persistence of memory: Forensic identification and extraction of cryptographic keys

Maartmann-Moe

Thorkildsen

íRnes

2009

Digital Investigation

View full text Add to dashboard Cite

Data hiding and recovery Memory analysis Memory dumping Applied cryptography Live analysis Cryptographic evidence Incident response Tool testing and development a b s t r a c t The increasing popularity of cryptography poses a great challenge in the field of digital forensics. Digital evidence protected by strong encryption may be impossible to decrypt without the correct key. We propose novel methods for cryptographic key identification and present a new proof of concept tool named Interrogate that searches through volatile memory and recovers cryptographic keys used by the ciphers AES, Serpent and Twofish. By using the tool in a virtual digital crime scene, we simulate and examine the different states of systems where well known and popular cryptosystems are installed. Our experiments show that the chances of uncovering cryptographic keys are high when the digital crime scene are in certain well-defined states. Finally, we argue that the consequence of this and other recent results regarding memory acquisition require that the current practices of digital forensics should be guided towards a more forensically sound way of handling live analysis in a digital crime scene.

show abstract

Section: Related Workmentioning

confidence: 99%

The persistence of memory: Forensic identification and extraction of cryptographic keys

Maartmann-Moe

Thorkildsen

íRnes

2009

Digital Investigation

View full text Add to dashboard Cite

show abstract

“…Files were also accessed at both blocklevel and file-level to estimate the granularity of the data being moved. (Solomon, Huebner, Bem, & Szeżynska, 2007) has used a similar approach to study persistence of data in memory. They made controlled changes to the system and took snapshots of the memory to analyze how the allocation changes with system changes that emulate a users usual behavior on the system.…”

Section: Analyzing the Movement Of Datamentioning

confidence: 99%

Exploring Forensic Implications of the Fusion Drive

Gupta¹,

Rogers²

2014

JDFSL

View full text Add to dashboard Cite

This paper explores the forensic implications of Apple's Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always maintained. If data on the magnetic drive is frequently accessed, it is promoted to the flash drive while demoting other information. Data is moved at a block-level and not a file-level. The Fusion Drive didn't alter the timestamps of files with data migration.

show abstract

“…Carrier and Grand [38] describe a hardware based memory acquisition procedure while Schatz [180] presents a software based volatile memory capture using BodySnatcher. Schuster [183,185] examines the presence of processes and threads in Windows memory dumps and examines memory allocation strategies in Windows Operating systems, Solomon et al [195] analyze user data persistence in physical memory and Mee et al [130] have examined the Windows registry as a forensic artifact. Schuster [184] describes the Microsoft Vista event log format and studies its forensic capabilities and Murphey [145] presents a methodology for automated event log forensics combining multiple logs.…”

Section: Forensic Acquisition Toolsmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

112

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

User data persistence in physical memory

Cited by 24 publications

References 1 publication

The persistence of memory: Forensic identification and extraction of cryptographic keys

The persistence of memory: Forensic identification and extraction of cryptographic keys

Exploring Forensic Implications of the Fusion Drive

Digital forensic research: current state of the art

Contact Info

Product

Resources

About