Abstract
There have been few investigations into the amount of relevant information that can be recovered from the physical memory of Windows applications. Extraction of user information is vital in today’s digital investigation and forensic investigators find it helpful to gain access to dispersal evidence stored over time in the physical memory of these applications. In this research, we present the quantitative and qualitative results of experiments carried out on the extraction of forensically relevant information from Windows computer systems. This process involves a pattern matching techniques of the original user input and the extracted memory dump strings processes. In conducting this research; we have identified the most commonly used applications on Windows systems, designed a methodology to capture data and processed that data. This research will report the amount of evidence dispersed over time in the physical memory when the application was running and user is not interacting with the system.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.