A framework for password harvesting from volatile memory

International Journal of Electronic Security and Digital Forensics

Volumn 4, Issue 2-3, 2012, Pages 154-163

  Karayianni, Stavroula ^a   Katos, Vasilios ^a   Georgiadis, Christos K ^b  

^a DEMOCRITUS UNIVERSITY OF THRACE   (Greece)

^b UNIVERSITY OF MACEDONIA   (Greece)

Author keywords

Data recovery; Memory forensics; Order of volatility

Indexed keywords

AUTHENTICATION;

CONFIDENTIAL DATA; CRIME SCENES; DATA RECOVERY; FIRST RESPONDERS; MEMORY FORENSICS; ORDER OF VOLATILITIES; VOLATILE MEMORY;

RANDOM ACCESS STORAGE;

EID: 84864669524     PISSN: 1751911X     EISSN: 17519128     Source Type: Journal    
DOI: 10.1504/IJESDF.2012.048411     Document Type: Article

References (12)

1. ACPO (2008) 'Good practice guide for computer-based electronic evidence', Association of Chief Police Officers, UK.
2. Adlestein, F. (2006) 'Live forensics: diagnosing your system without killing it first'. Communications of the ACM, Vol. 49, No. 2, pp.63-66.
3. Carrier, B. and Spafford, E. (2006) 'Categories of digital investigation analysis techniques based on the computer history model', Digital Investigation, Vol. 3S, pp.121-130. (Pubitemid 44066911)
4. Chan, E., Carlyle, J., David, F., Farivar, R. and Campbell, R. (2008) 'BootJacker: compromising computers using forced restarts' 15th ACM Conference on Computer and Communications Security, 27-31 October, Virginia, USA.
5. Garfinkel, S. (2007) 'Carving contiguous and fragmented files with fast object validation', Digital Investigation, Supplement, Vol. 4, pp.2-12. (Pubitemid 47081435)
6. Gavitt, B. (2008) 'Forensic analysis of the Windows registry in memory', Digital Investigation, Supplement, Vol. 5, pp.26-32.
7. Gutmann, P. (1996) 'Secure deletion of data from magnetic and solid-state memory', Sixth USENIX Security Symposium, San Jose, California, 22-25 July, pp.77-89.
8. Gutmann, P. (2001) 'Data remanence in semiconductor devices', 10th USENIX Security Symposium, pp.39-54.
9. Halderman, J., Schoen, S., Heninger, N., Clarkson, W.P.J., Calandrino, A., Feldman, A. Appelbaum, J. and Felte, E. (2008) 'Lest we remember: cold boot attacks on encryption key', 2008 USENIX Security Symposium.
10. National Institute of Justice (NIJ) (2008) Electronic Crime Scene Investigation: A Guide for First Responders, 2nd ed., available at http://www.ncjrs.gov/pdffiles1/nij/ 219941.pdf (accessed on 20 June 2011).
11. van Baar, R., Alink, W. and van Ballegooij, A. (2008) 'Forensic memory analysis: files. Mapped in memory', Digital Investigation, Supplement, Vol. 5, pp.52-57.
12. Volatile Systems (2011) 'The volatility framework: volatile memory artifact extraction utility framework', available at https://www. volatilesystems.com/default/volatility (accessed on 20 June 2011).