The impact of the antivirus on the digital evidence

Abstract

Digital forensics DF has a significant role in accusing cyber criminals and proving them guilty. A criminal, if possible, may manage to delete the crime evidences in order to deny her responsibility about the crime. As the antivirus AV becomes an essential security component, this paper studies the effect of the AV on the digital evidence. The AV intercepts many system operations to check if the involved data contain malicious contents. This paper studies the effect of the AV on data from forensics perspectives. We design representing experiments and check if the AV affects the RAM artefacts of the involved tasks. We test three common AVs and show that the AV has an obvious effect on the RAM artefacts. To the best of our knowledge, we are the first to study the impact of the AV on the digital evidence.