Title :
Towards the Virtual Memory Space Reconstruction for Windows Live Forensic Purposes
Author :
Savoldi, Antonio ; Gubian, Paolo
Author_Institution :
Dept. of Electron. for Autom., Univ. of Brescia, Brescia
Abstract :
The aim of this paper is to demonstrate the usefulness of the pagefile in a live forensic context. The forensic science is striving to find new methodologies to analyze the massive quantity of data normally present in a medium-sized workstation, which can have up to several terabytes of storage devices. As a result, the live forensic approach seems to be the only one which can guarantee promptness in obtaining evidential data to be used in the investigative process. The current approach of volatile forensic analysis does not consider the pagefile as an important element to be used in the analysis. Therefore, we have developed a solution which permits to correlate evidential data within the pagefile to the relative process located in the RAM dump. This work can be considered a natural extension of our previous work on this topic.
Keywords :
paged storage; read-only storage; security of data; RAM; pagefile; virtual memory space reconstruction; volatile forensic analysis; windows live forensic purposes; Automation; Computer networks; Digital forensics; Hardware; Image reconstruction; Operating systems; Performance analysis; Random access memory; Read-write memory; Workstations; Live forensic analysis; memory address translation scheme; pagefile; virtual memory analysis;
Conference_Titel :
Systematic Approaches to Digital Forensic Engineering, 2008. SADFE '08. Third International Workshop on
Conference_Location :
Oakland, CA
Print_ISBN :
978-0-7695-3171-7
DOI :
10.1109/SADFE.2008.21
