Collecting sensitive information from windows physical memory

Journal of Computers

Volumn 4, Issue 1, 2009, Pages 3-10

  Zhao, Qian ^a,b   Cao, Tianjie ^a,b  

^a CHINA UNIVERSITY OF MINING AND TECHNOLOGY   (China)

^b SOUTHEAST UNIVERSITY   (China)

Author keywords

Live system; Memory forensics; Sensitive information

Indexed keywords

COMPUTER SCIENCE;

CHAT LOGS; HARD DRIVES; LIVE SYSTEM; MEMORY FORENSICS; PHYSICAL MEMORY; SENSITIVE INFORMATIONS; TARGET SYSTEMS;

AUTHENTICATION;

EID: 68749122104     PISSN: 1796203X     EISSN: None     Source Type: Journal    
DOI: 10.4304/jcp.4.1.3-10     Document Type: Conference Paper

References (21)

1. RFC 3227, Guidelines for Evidence Collection and Archiving. http:// www.faqs.org/rfcs/rfc3227.html, 2002
2. W. Chisum and B. Turvey, "Evidence dynamics: Locard's exchange principle and crime reconstruction", Journal of Behavioral Profiling, vol.1, January 2000.
3. H. Carvey, Windows Foreniscs Analysis DVD Toolkit, 2005.
4. B. D. Carrier and J. Grand. "A hardware-based memory acquisition procedure for digital investigations", Journal of Digital Investigations, vol. 1, pp. 50-60, February 2004.
5. http://ntsecurity.nu/onmymind/2006/2006-09-02.html
6. G. M. Garner, Forensic Acquisition Utilities, http:// www.gmgsystemsinc.com/fau/.
7. http://www.vmware.com/
8. S. Bradley, "BodySnatcher: Towards reliable volatile memory acquisition by software", Journal of Digital Investigations, vol. 4, pp. 126-134, September 2007
9. http://www.x-ways.net/winhex/index-m.html
10. "Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000", http://support.microsoft.com/kb /254649/en-us
11. "Windows feature lets you generate a memory dump file by using the keyboard", http://support.microsoft.com/kb/244139/en-us
12. http://www.microsoft.com/whdc/devtools/debugging/default.mspx
13. http://www.ultraedit.cn/
14. "Complete memory dumps are not available on computers that have 2 or more gigabytes of RAM", http://support.microsoft.com/kb/274598/en-us
15. N. Ruff, "Windows memory forensics", Journal of Computer Virology, vol. 4, pp. 83-100, May 2008.
16. J. Rutkowska, "Subverting Vista Kernel", http:/ /invisiblethings.org/papers /joanna%20rutkowska%20-%20subverting%20vista%20kernel.ppt
17. http://www.runtime.org/
18. http://www.accessdata.com/catalog/partdetail.aspx?partno=11000
19. http://www.x-ways.net/forensics/index-m.html
20. http://www.ilook-forensics.org/
21. S. Lee, H. Kim, S. Lee, and J. Lim, "Digital evidence collection process in integrity and memory information gathering", In Proceedings of Systematic Approaches to Digital Forensic Engineering, First International Workshop, Proc. IEEE, pp. 236-247, 2005.