Persistent systems techniques in forensic acquisition of memory

Digital Investigation

Volumn 4, Issue 3-4, 2007, Pages 129-137

  Huebner, Ewa ^a   Bem, Derek ^a   Henskens, Frans ^b   Wallis, Mark ^b  

^a UNIVERSITY OF WESTERN SYDNEY   (Australia)

^b UNIVERSITY OF NEWCASTLE   (Australia)

Author keywords

Computer forensics; Memory acquisition; Memory forensics; Memory persistence; Persistent operating systems

Indexed keywords

COMPUTER AIDED ANALYSIS; COMPUTER AIDED SOFTWARE ENGINEERING; COMPUTER OPERATING SYSTEMS; DATA ACQUISITION;

COMPUTER FORENSICS; MEMORY-RELATED TOOLS; UNIX DERIVATIVES;

PATTERN RECOGNITION;

EID: 40849087846     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2008.02.001     Document Type: Article

References (47)

1. Anderson G., and Karakas C. GNU/Linux command-line tools summary (2006), Linuxtopia. http://www.linuxtopia.org/online_books/gnu_linux_tools_guide/index.html
2. Atkinson MP, Morrison R. Persistent systems architecture. The proceedings of the 3rd international workshop on persistent object systems; 1988. p. 1-22.
3. Barth P., Mears J., and Green A. Project B (Hacking) overview, Xbox-Linux (2002). http://www.xbox-linux.org/docs/projectboverview.html
4. Becher M., Dornseif M., and Klein C.N. FireWire all your memory are belong to us (2005), CanSecWest, Vancouver, BC, Canada
5. Bem D, Huebner E. Computer forensics analysis in virtual environments. Int J Digit Evid, in press.
6. Bem EZ, Rosenberg J. An algorithm for stabilising multiple stores. In: The proceedings of the 9th workshop on ACM SIGOPS European workshop; 2000. p. 139-45.
7. Bem EZ, Rosenberg J. An approach to implementing persistent computations. In: The proceedings of 9th international workshop on persistent object systems; 2000. p. 189-204.
8. Boileau A. Hit by a bus: physical access attacks with Firewire, Ruxcon (2006), University of Technology Sydney, Australia
9. Brown A.L., and Rosenberg J. Persistent programming systems: an implementation technique. In: Dearle G.S.A., and Zdonik S. (Eds). 4th international workshop on persistent object systems (1990), Morgan Kaufmann 199-212
10. Bunting S., and Wei W. EnCase computer forensics: the official EnCE: EnCase certified examiner study guide (2006), Wiley Publishing, Indianapolis, IN
11. Burdach M. Digital forensics of the physical memory. Available from (2005). http://forensic.seccure.net/
12. Burdach M. Windows memory forensic toolkit. Available from (2007). http://forensic.seccure.net/
13. Carrier B.D., and Grand J. A hardware-based memory acquisition procedure for digital investigations. Digit Investig J 1 (2004)
14. Carvey H. Windows forensic analysis (2007), Syngress, Rockland, Massachusetts, U.S.A.
15. Casey E. Digital evidence and computer crime (2004), Elsevier Academic Press, London, UK
16. Clark T. Storage virtualisation technologies for simplifying data storage and management (2005), Pearson Education, Upper Saddle River, NJ
17. Dearle A., Bona R.D., Farrow J., Henskens F.A., Lindstroem A., Rosenberg J., et al. Grasshopper: an orthogonally persistent operating system. J Comput Syst 7 (1994) 289-312
18. EnCase. Guidance software development and training. Retrieved 9 February 2007, from (2007). http://www.guidancesoftware.com/training/
19. Farmer D., and Venema W. Forensic discovery (2005), Addison-Wesley, Upper Saddle River, NJ
20. Hart S.V. Forensic examination of digital evidence: a guide for law enforcement. Technical Working Group for Electronic Crime Scene Investigation (April 2004), U.S. Department of Justice Office of Justice Programs. http://www.ojp.usdoj.gov/nij/pubs-sum/199408.htm
21. Huebner E., Bem D., and Wee C.K. Data hiding in the NTFS file system. Digit Investig 3 (Spring 2006)
22. Hyde R. The art of assembly language programming (2000). http://www.arl.wustl.edu/∼lockwood/class/cs306/books/artofasm/
23. International Organization on Computer Evidence. Guidelines for best practice in the forensic examination of digital technology (2002). http://www.ioce.org/fileadmin/user_upload/2002/ioce_bp_exam_digit_tech.h tml
24. Internet Virtual Storage. Retrieved 20 November 2006, from (2007). http://www.cryer.co.uk/resources/virtualstorage.htm
25. Jalili R, Henskens FA. Using directed graphs to describe entity dependency in stable distributed persistent stores. In: Proceedings of 28th Hawaii international conference on system sciences; 1995. p. 665-74.
26. Johnson M.K. Red Hat, Inc.'s network console and crash dump facility (2007). http://www.redhat.com/support/wpapers/redhat/netdump/
27. Jones K., Bejtlich R., and Curtis R. Real digital forensics: computer security and incident response (2005), Penguin Books Pearson Publishing
28. Keedy J.L. Support for objects in the MONADS architecture. Proceedings of the third international workshop on persistent object systems (1989), Springer, Newcastle, New South Wales, Australia
29. Kerr O.S. Searches and seizures in a digital world. Harv L Rev 119 (2005-2006)
30. Kruse II W.G., and Heiser J.G. Computer forensics: incident response essentials (2002), Addison Wesley Professional
31. Landau C.R. The checkpoint mechanism in KeyKOS. Proceedings of the 2nd international workshop on object orientation in operating systems (1992), IEEE 86-91
32. Lindstroem A.G., Dearle A., Bona R.D., Farrow J.M., Henskens F.A., and Rosenberg J. A model for user-level memory management in a persistent distributed environment. In: Gupta G. (Ed). Proceedings of the 17th Australasian computer science conference, New Zealand (1994) 343-354
33. LiveWire Investigator. Retrieved 12 May 2007, from (2007), WetStone Technologies Inc. http://www.wetstonetech.com/f/forensictools.html
34. Microsoft. Microsoft Xbox. http://www.xbox.com/en-US/
35. MicroSoft. Windows feature lets you generate a memory dump file by using the keyboard (2007). http://support.microsoft.com/default.aspx/kb/244139/en-us
36. Mount Image Pro. Retrieved 12 February 2007, from (2007). http://www.mountimage.com/
37. Petroni J.N.L., Walters A., Fraser T., and Arbaugh W.A. FATKit: a framework for the extraction and analysis of digital forensic data from volatile system memory. Digit Investig 3 (2006) 197-210
38. Russinovich M.E., and Solomon D.A. Microsoft windows internals (2005), Microsoft Press, Redmond
39. Saferstein R. Forensic science handbook (2001), Prentice Hall
40. Schuster A. Searching for processes and threads in Microsoft Windows memory dumps. In: The proceedings of the 6th annual digital forensic research workshop; 2006. p. 10-6.
41. Singh A. Mac OS X internals: a systems approach (2006), Addison Wesley Professional
42. Solomon D.A., and Russinovic M.E. Inside Microsoft Windows 2000. 3rd ed. (2000), Microsoft Press
43. Spitzner L. Know your enemy - the tools and methodologies of the script Kiddie, Honeynet Project (2000). http://www.honeynet.org/papers/enemy/
44. Technology Pathways, LLC. ProDiscover Forensics. Retrieved 20 October 2006, from (2006). http://www.techpathways.com/ProDiscoverDFT.htm
45. Vaughan F., Basso T., Dearle A., Marlin C., and Barter C. A cached architecture supporting persistence. Comput Syst 5 (1992) 337-359
46. X-Ways Software Technology AG. X-Ways software for forensics, data recovery and IT security. Retrieved 1 March 2007, from (2007). http://www.winhex.com/
47. Zittrain J. Searches and seizures in a networked world. Harv L Rev F 119 (2006)