Extraction of User Information by Pattern Matching Techniques in Windows Physical Memory

Abstract

There have been few investigations into the amount of relevant information that can be recovered from the physical memory of Windows applications. Extraction of user information is vital in today’s digital investigation and forensic investigators find it helpful to gain access to dispersal evidence stored over time in the physical memory of these applications. In this research, we present the quantitative and qualitative results of experiments carried out on the extraction of forensically relevant information from Windows computer systems. This process involves a pattern matching techniques of the original user input and the extracted memory dump strings processes. In conducting this research; we have identified the most commonly used applications on Windows systems, designed a methodology to capture data and processed that data. This research will report the amount of evidence dispersed over time in the physical memory when the application was running and user is not interacting with the system.