A hardware-based memory acquisition procedure for digital investigations

Digital Investigation

Volumn 1, Issue 1, 2004, Pages 50-60

  Carrier, Brian D ^a   Grand, Joe ^b  

^a Purdue University   (United States)

^b Grand Idea Studio Inc   (United States)

Author keywords

Computer forensics; Digital evidence; Digital investigations; Incident response; Volatile data acquisition

Indexed keywords

AUTOMATION; COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; CRYPTOGRAPHY; DATA ACQUISITION; DIGITAL STORAGE; INSTALLATION; RESEARCH; SERVERS;

COMPUTER FORENSICS; DIGITAL EVIDENCE; DIGITAL INVESTIGATIONS; INCIDENT RESPONSE; MEMORY ACQUISITION; VOLATILE DATA ACQUISITION;

ELECTRONIC CRIME COUNTERMEASURES;

EID: 3042731401     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2003.12.001     Document Type: Article

References (19)

1. CAIDA. Analysis of Code-Red. http://www.caida.org/analysis/security/code- red/:July 2001;
2. Carrier Brian, Spafford Eugene. Getting physical with the digital investigation process. Int J Digit Evid. Fall:2003.
3. Casey Eoghan. Practical approaches to recovering encrypted digital evidence. Int J Digit Evid. Fall:2002.
4. Compuware. SoftICE. http://www.compuware.com/.
5. Drake Chris, Brown Kimberley. PANIC! UNIX system crash dump analysis handbook. 1995;Pearson Education.
6. Farmer Dan, Venema Wietse. The Coroner's Toolkit (TCT). http://www.fish.com/tct/.
7. Garner George. Forensic acquisition utilities. http://users.erols.com/ gmgarner/forensics/.
8. Hewlett-Packard, Intel, Microsoft, Phoenix, Toshiba. Advanced configuration and power interface specification. http://www.acpi.info/spec.htm.
9. Hitachi. Microdrive overview page. http://www.hgst.com/hdd/micro/overvw. htm.
10. Intel. i960 CTOOLS. http://developer.intel.com/design/i960/patches/index. htm.
11. Intel. IOP303 I/O processor. http://developer.intel.com/design/iio/80303. htm.
12. ISS X-Force. SQL Slammer worm propagation. http://xforce.iss.net/xforce/ xfdb/11153:January 2003;
13. Lawless Timothy. Linux kernel-level Trojan - kernel intrusion system (KIS). http://archives.neohapsis.com/archives/sf/linux/2001-q3/0038.html.
14. National Institute of Standards and Technology. Computer Forensic Tool Testing (CFTT) group. http://www.cftt.nist.gov.
15. National Institute of Standards and Technology. Disk imaging tool specification. http://www.cftt.nist.gov/DI-spec-3-1-6.doc:October 2001;
16. Shanley Tom, Anderson Don. PCI system architecture. 4th ed. 2000;Pearson Education.
17. Smith Fred, Bace Rebecca. A guide to forensic testimony. 2003;Addison Wesley.
18. Venema Wietse. Forensic discovery. http://www.lysator.liu.se/upplysning/ fa/wietse_susec.pdf.
19. VMWare, Inc. VMWare GSX server. http://www.vmware.com/.