Comparative analysis of volatile memory forensics, live response vs. memory imaging

Proceedings - 2011 IEEE International Conference on Privacy, Security, Risk and Trust and IEEE International Conference on Social Computing, PASSAT/SocialCom 2011

Volumn , Issue , 2011, Pages 1253-1258

  Aljaedi, Amer ^a   Lindskog, Dale ^a   Zavarsky, Pavol ^a   Ruhl, Ron ^a   Almari, Fares ^a  

^a Department of Philosophy and Religious Studies   (Canada)

Author keywords

Incident response; Live response; Memory analysis; Volatile data forensics

Indexed keywords

ALTERNATIVE APPROACH; ALTERNATIVE METHODS; COMPARATIVE ANALYSIS; DIGITAL FORENSIC; DIGITAL INVESTIGATION; INCIDENT RESPONSE; LIVE RESPONSE; MEMORY ANALYSIS; MEMORY CAPACITY; RUNNING TASKS; VOLATILE DATA; VOLATILE MEMORY;

IMAGE ANALYSIS;

COMPUTER CRIME;

EID: 84856143282     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PASSAT/SocialCom.2011.68     Document Type: Conference Paper

References (24)

1. B. D. Carrier and J. Grand, "A hardware-based memory acquisition procedure for digital investigations, " Digital Investigation, vol. 1, pp. 50-60, February 2004.
2. M. Burdach, "Finding digital evidence in physical memory, " presented at 2006 Black Hat Federal Conference. Sheraton Crystal City, Washington DC, January 2006.
3. CAIDA Analysis of Code-Red. (2001). [Online]. Available: http://www.caida.org/research/security/code-red/.
4. SQL Slammer worm propagation. (2003). [Online]. Available: http://xforce.iss.net/xforce/xfdb/11153.
5. NIST Special Publication 800-61, Computer Security Incident Handling Guide, 2008. [Online]. Available:http://csrc.nist.gov/publications/nistpubs/800- 61-rev1/SP800-61rev1.pdf.
6. RFC 3227 standard of evidence collection, Guidelines for Evidence Collection and Archiving. [Online]. Available: http://tools.ietf.org/html/ rfc3227.
7. Incident Handling Step-by-Step and Computer Crime Investigation, In Security 504 Hacker Techniques, Exploits, and Incident Handling. SANS Institute, 2008.
8. Electronic Crime Scene Investigation: A Guide for First Responders, 2nd ed., April 2008. [Online]. Available: http://www.ncjrs.gov/pdffiles1/nij/219941. pdf.
9. C. Waits, J. Akinyele, R. Nolan, and L. Rogers, "Computer forensics: results of live response inquiry vs. memory image analysis, " CERT program, CMU/SEI-2008-TN-017, August 2008.
10. A. Case, L. Marziale, C. Neckar, and G. Richard, "Treasure and tragedy in kmem-cache mining for live forensics investigation, " Digital Investigation, vol.7, pp. S32-S40, 2010.
11. A. Case, L. Marziale, and G. Richard, "Dynamic recreation of kernel data structures for live forensics, " Digital Investigation, vol. 7, pp. S41-S47, 2010.
12. J. M. Urrea, "An Analysis of Linux Ram Forensics, " M.S. thesis, Dept. Computer science, Naval Postgraduate School, March 2006.
13. M. Burdach, "Digital Forensics of the Physical Memory, " unpublished, March 2005. [Online]. Available: http://strony.aster.pl/forensics/ pdf/mburdach-digital-forensics-of-physical-memory.pdf.
14. A. Case, A. Cristina, L. Marziale, G. Richard, and V. Roussev, "FACE: Automated digital evidence discovery and correlation, " Digital Investigation, vol. 5, pp. S65-S75, 2008.
15. Digital Forensics Solutions. [Online]. Available: http://dfsforensics. blogspot.com/2011/03/bringing-linux-support-to-volatility.html.
16. Red Hat Crash Utility. [Online]. Available: http://people.redhat.com/ Anderson/crash-whitepaper/.
17. Net Analysis, Digital Detective. [Online]. Available: http://www.digital-detectiv.co.uk/netanalysis.asp.
18. Access Date, Decryption and Password Cracking Software. [Online]. Available:http://accessdata.com/products/computer-forensics/decryption.
19. EnCase, New EnCase Forensic Packs Encryption Punch. [Online]. Available: http://investors.guidancesoftware.com/releasedetail.cfm?releaseid=528370.
20. D. Farmer and W. Venema, "Beyond processes" in Forensic Discovery, 1st ed. Addison-Wesley, 2004, ch. 8, pp. 161-185.
21. DFRWS 2008 Forensics Challenge Results. [Online]. Available:http://www. dfrws.org/2008/challenge/results.shtml.
22. DFRWS 2005 Forensics Challenge. [Online]. Available: http://www.dfrws. org/2005/challenge/.
23. A. Walters and N. Petroni, "Volatools: integrating volatile memory forensics into the digital investigation process, " Black Hat DC 2007, February 2007.
24. Volatile Systems website. [Online]. Available: https://www. Volatilesystems.com/default/volatility#overview.