Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
458125 | Digital Investigation | 2013 | 11 Pages |
Abstract
Memory forensics has gradually moved into the focus of researchers and practitioners alike in recent years. With an increasing effort to extract valuable information from a snapshot of a computer's RAM, the necessity to properly assess the respective solutions rises as well. In this paper, we present an evaluation platform for forensic memory acquisition software. The platform is capable of measuring distinct factors that determine the quality of a generated memory image, specifically its correctness, atomicity, and integrity. Tests are performed for three popular open source applications, win32dd, WinPMEM, and mdd, as well as for different memory sizes.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
Stefan Vömel, Johannes Stüttgen,