Towards the Virtual Memory Space Reconstruction for Windows Live Forensic Purposes

Author

Savoldi, Antonio ; Gubian, Paolo

Author_Institution

Dept. of Electron. for Autom., Univ. of Brescia, Brescia

fYear

2008

fDate

22-22 May 2008

Firstpage

15

Lastpage

22

Abstract

The aim of this paper is to demonstrate the usefulness of the pagefile in a live forensic context. The forensic science is striving to find new methodologies to analyze the massive quantity of data normally present in a medium-sized workstation, which can have up to several terabytes of storage devices. As a result, the live forensic approach seems to be the only one which can guarantee promptness in obtaining evidential data to be used in the investigative process. The current approach of volatile forensic analysis does not consider the pagefile as an important element to be used in the analysis. Therefore, we have developed a solution which permits to correlate evidential data within the pagefile to the relative process located in the RAM dump. This work can be considered a natural extension of our previous work on this topic.

Keywords

paged storage; read-only storage; security of data; RAM; pagefile; virtual memory space reconstruction; volatile forensic analysis; windows live forensic purposes; Automation; Computer networks; Digital forensics; Hardware; Image reconstruction; Operating systems; Performance analysis; Random access memory; Read-write memory; Workstations; Live forensic analysis; memory address translation scheme; pagefile; virtual memory analysis;

fLanguage

English

Publisher

ieee

Conference_Titel

Systematic Approaches to Digital Forensic Engineering, 2008. SADFE '08. Third International Workshop on

Conference_Location

Oakland, CA

Print_ISBN

978-0-7695-3171-7

Type

conf

DOI

10.1109/SADFE.2008.21

Filename

4545364