Suspects' data hiding at remaining registry values of uninstalled programs

e-Forensics 2008 - Proceedings of the 1st International Conference on Forensic Applications and Techniques in Telecommunications, Information, and Multimedia and Workshop

Volumn , Issue , 2008, Pages

  Kim, Youngsoo ^a   Lee, Sangsu ^a   Hong, Dowon ^a  

^a Electronics and Telecommunications Research Institute (ETRI)   (South Korea)

Author keywords

Data hiding; Digital Forensics; Windows Registry

Indexed keywords

DIGITAL FORENSICS; STEGANOGRAPHY;

DATA HIDING; EVIDENTIAL VALUE; FORENSIC ANALYSIS; FORENSIC EVIDENCE; FORENSIC TOOLS; WINDOWS REGISTRY; WINDOWS XP;

COMPUTER FORENSICS;

EID: 84925331979     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.4108/e-forensics.2008.33     Document Type: Conference Paper

References (7)

1. J. Honeycutt, "Microsoft Windows XP Registry Guide," Microsoft Press, 2003.
2. M. Russinovich, "Inside the Registry," Windows NT Magazine, 1997.
3. K.J.Jones, R. Bejtlich, and C.W. Rose, "Real Digital Forensics," Addison-Wesley, 2006.
4. H. Carvey, "Windows Forensics and Incident Recovery," Addison-Wesley, 2004.
5. C. Steel, "Windows Forensics," Wiley Publising, Inc., 2006.
6. L.W. Wong, "Forensic Analysis of the Windows Registry," Forensic Focus, 2006.
7. Y.S. Kim, S.S. Lee, and D.W. Hong, "Windows Registry and Hiding Suspects' Data in Registry," the First Workshop for Anti-Forensics and Countermeasures, 2007.