Memory forensics for QQ from a live system

Journal of Computers

Volumn 5, Issue 4, 2010, Pages 541-548

  Gao, Yuhang ^a   Cao, Tianjie ^a  

^a CHINA UNIVERSITY OF MINING AND TECHNOLOGY   (China)

Author keywords

Instant messaging; Memory analysis; Memory forensics; Microsoft windows; The qq client

Indexed keywords

INSTANT MESSAGING; MEMORY ANALYSIS; MICROSOFT WINDOWS; PAGING FILE; SENSITIVE INFORMATIONS;

MESSAGE PASSING;

WORLD WIDE WEB;

EID: 78651525326     PISSN: 1796203X     EISSN: None     Source Type: Journal    
DOI: 10.4304/jcp.5.4.541-548     Document Type: Article

References (17)

1. Dickson M. An examination into MSN Messenger 7.5 contact identification. Digital Investigation Volume 3, Issue 2, June 2006, Pages 79-83.
2. Dickson M. An examination into Yahoo Messenger 7.0 contact identification. Digital Investigation, Volume 3, Issue 3, September 2006, Pages 159-165.
3. Dickson M. An examination into AOL Instant Messenger 5.5 contact identification. Digital Investigation, Volume 3, Issue 4, December 2006, Pages 227-237.
4. Dickson M. An examination into Trillian basic 3.x contact identification. Digital Investigation, Volume 4, Issue 1, March 2007, Pages 36-45.
5. van Dongen Wouter S. Forensic artefacts left by Windows Live Messenger 8.0. Digital Investigation, Volume 4, Issue 2, June 2007, Pages 73-87.
6. Wouter S. van Dongen. Forensic artefacts left by Pidgin Messenger 2.0. Digital Investigation, Volume 4, Issues 3-4, September-December 2007, Pages 138-145.
7. R.B. van Baar, W. Alink, A.R. van Ballegooij. Forensic memory analysis: Files mapped in memory. Digital Investigation, Volume 5, Issues 1-2, September 2008, Pages 34-48.
8. Andreas Schuster. The impact of Microsoft Windows pool allocation strategies on memory forensics. Digital Investigation Volume 5, Supplement 1, September 2008, Pages S58-S64.
9. Sven B. Schreiber, Undocumented Windows 2000 secrects, aprogrammer's cookbook. Pearson Education Corporate;2001.
10. Win32dd - a free kernel land and 100% open -source tool to acquire physical memory. http://win32dd.msuiche.net/.
11. Microsoft. Windows feature lets you generate a memory dump file by using the keyboard.
12. David R. Piegdon and Lexi Pimenidis. Targeting Physical Address Memory. Detection of Intrusions and Malware, and Vulnerability Assessment, Volume 4579. 2007. Pages 193-212.
13. Russinovich Mark, Solomon David. Microsoft Windows internals. 4th ed. Redmond, Washington: Microsoft Press; 2005.
14. Kornblum Jesse D. Using every part of the buffalo in windows memory analysis. Digital Investigation 2007;4:24-9.
15. Schuster Andreas. Searching for processes and threads in Microsoft windows memory dumps. Digital Investigation 2006;3; 10-6
16. Rich Text Format (RTF) Specification, version 1.6 http://msdn.microsoft.com/en-us/library/aa140277.aspx.
17. Qian Zhao, Tianjie Cao. Collecting Sensitive Information from Windows Physical Memory, Journal of Computer, pp. 3-10, Volume 4, Number 1, January 2009.