Windows Operating System Research Articles

The Influence of Virtual Secure Mode (VSM) on Memory Acquisition

Recently, acquiring the Random Access Memory (RAM) full memory and access data is gaining significant interest in digital forensics. However, a security feature on the Windows operating system - Virtual Secure Mode (VSM) - presents challenges to the acquisition process by causing a system crash known as a Blue Screen of Death (BSoD). The crash is likely to occur when memory acquisition tools are being used. Subsequently, it disrupts the goal of memory acquisition since the system must be restarted, and the RAM content is no longer available. This study analyzes the implications of VSM on memory acquisition tools as well as examines to what extent its impact on the acquisition process. Two memory acquisition tools, namely FTK Imager and Belkasoft RAM Capturer, were used to conduct the acquisition process. Static and dynamic code analyses were performed by using reverse engineering techniques that are disassembler and debugger. The results were compared based on the percentage of unreadable memory between active and inactive VSM. Static analysis showed that there is no difference between all applications’ functions for both active and inactive VSM. Further Bugcheck analysis of the MEMORY.DMP is pointed to the ad_driver.sys module in FTK Imager that causes the system to crash. The percentage of unreadable memory while running on active VSM and inactive VSM for Belkasoft is about 0.6% and 0.0021%, respectively. These results are significant as a reference to digital investigators as consistent with the importance of RAM dump in live forensics.

Key-Value Store Coupled with an Operating System for Storing Large-Scale燰alues

The key-value store can provide flexibility of data types because it does not need to specify the data types to be stored in advance and can store any types of data as the value of the key-value pair. Various types of studies have been conducted to improve the performance of the key-value store while maintaining its flexibility. However, the research efforts storing the large-scale values such as multimedia data files (e.g., images or videos) in the key-value store were limited. In this study, we propose a new key-value store, WR-Store++ aiming to store the large-scale values stably. Specifically, it provides a new design of separating data and index by working with the built-in data structure of the Windows operating system and the file system. The utilization of the built-in data structure of the Windows operating system achieves the efficiency of the key-value store and that of the file system extends the limited space of the storage significantly. We also present chunk-based memory management and parallel processing of WR-Store++ to further improve its performance in the GET operation. Through the experiments, we show that WR-Store++ can store at least 32.74 times larger datasets than the existing baseline key-value store, WR-Store, which has the limitation in storing large-scale data sets. Furthermore, in terms of processing efficiency, we show that WR-Store++ outperforms not only WR-Store but also the other state-of-the-art key-value stores, LevelDB, RocksDB, and BerkeleyDB, for individual key-value operations and mixed workloads.

Cybersecurity: Identifying the Vulnerability Intensity Function (<i>VIF</i>) and Vulnerability Index Indicator (<i>VII</i>) of a Computer Operating System

The objective of the present study is to define two important aspects of the computer operating system concerning the number of its vulnerabilities behavior. We identify the Vulnerability Intensity Function (VIF), and the Vulnerability Index Indicator (VII) of a computer operating network. Both of these functions, VIF and VII are entities of the stochastic process that we have identified, which characterizes the probabilistic behavior of the number of vulnerabilities of a computer operating network. The VIF identifies the rate at which the number of vulnerabilities changes with respect to time. The VII is an important index indicator that conveys the following information about the number of vulnerabilities of Desktop Operating Systems: the numbers are increasing, decreasing, or remaining the same at a particular time of interest. This decision type of index indicator is crucial in every strategic planning and decision-making. The proposed VIF and VII illustrate their importance by using real data for Microsoft Windows Operating Systems 10, 8, 7, and Apple MacOS. The results of the actual data attest to the importance of VIF and VII in the cybersecurity problem we are currently facing.

PERANCANGAN SISTEM PEMPROSES TRANSAKSI PENJUALAN SUKU CADANG MESIN OUTBOAT PADA CV. DINAMIKA MARINE

The aim of this research is; 1) To find out the Design of Outboat Engine Parts Sales Transaction Processing System on CV. Dinamika Marine, 2) To design a Transaction Processing System for Sales of Outboat Engine Parts on CV. Web-based Marine Dynamics, AND 3) The design that will be built later is a sales transaction prototype that runs on the Windows operating system and does not require an internet connection. In making this model, the researcher compiled a data flow diagram that used a logical data flow diagram to describe the system to be proposed, while the prototype development process used the waterfall method. the results of the research include; 1) This Outboat Engine Spare Parts Sales application makes it easier to process transaction data and stock data based on sales, firstly the old system analysis, a user needs analysis, system feasibility analysis, system design which includes process modeling with DAD as a design tool, data modeling by making table designs, and designing interface designs and built using a web-based programming language with a database created using MySQL, and 2) The level of accuracy of this application in terms of recording transactions and stocks of Outboat Engine Parts can be seen by day, month and certain years so as to reduce the level of human error. This application can handle changes that occur, such as price changes and additional types of goods, these changes can be processed on the sales transaction form. The application is simple, the language used is easy for the user to understand, so it does not require a long time for training in operating this application

Створення комп'ютерних засобів керування автономним літальним апаратом з застосуванням дистанційних хмарних обчислень

The possibility of creating a computer control system for an unmanned aerial vehicle using remote cloud computing according to predefined scenarios from the user's desktop is investigated. For this, an experimental setup was created, which includes a quadcopter, a personal computer with the Windows operating system, an on-board computer Raspberry-3 with the Linux operating system, a Pi Camera V2 camcorder, and a Pixhawk autopilot. To model the control and transmission of video images the own control programs and photo pursuit on a computer Raspberry-3 in Python are recorded. Based on the obtained results, a model of unmanned aerial vehicle control from the desktop of the user's personal computer via the on-board computer without the use of a standard control panel and operator is proposed.

FEATURES OF FUNCTIONING AND SETTING OF THE SOFTWARE REGISTRAR OF SETTLEMENT TRANSACTIONSIN UKRAINE

Since August 1, 2020, in Ukraine, along with the traditional registrars of settlement transactions (RST) it is possible to use software RST, which is a technological and / or software solution used on any device in which the fiscal functions are realized through the fiscal server of the regulatory authority. Such a solution is designed to register settlement transactions for the sale of goods (provision of services), currency trading transactions in cash and / or register the number of sold goods (provided services), cash acceptance transactions for further transfer. Thus, software RST can be installed on any device (smartphone, tablet, laptop, etc.), which is certainly one of its advantages over traditional RST. It is more convenient to use a computer or notebook as a base of software RST on the premises, while for couriers, cab drivers, mobile points of sale for coffee, ice cream, etc. the most optimal is the use of a smartphone. Mandatory paper receipts will soon become an archaism. Along with them, entrepreneurs can now provide customers with electronic versions of receipts by email or in the form of a QR code. Thus, the introduction of a software registrar of settlement transactions is a step into the future in which more and more habitual activities in all spheres of life will be transferred online. The article gives an overview of the features of functioning of the program registrar of settlement operations. The advantages of its use for business, based on a comparison of its work with the hardware registrar of accounting transactions, are described. Describes the scenario by which checks are fiscalized in the office of the State Tax Service (STS) through the use of PRST. The development of the commercial PRST as a module that can be used for integration with the accounting software on the Windows operating system is carried out. An example of XML filter for receipts and their fiscalization is given. Describes the settings required for the correct operation of the commercial PRST according to the legislation of Ukraine, which allowed to simplify the process of settlement transactions in the field of trade and increase their automation.

EntropyHub: An open-source toolkit for entropic time series analysis.

An increasing number of studies across many research fields from biomedical engineering to finance are employing measures of entropy to quantify the regularity, variability or randomness of time series and image data. Entropy, as it relates to information theory and dynamical systems theory, can be estimated in many ways, with newly developed methods being continuously introduced in the scientific literature. Despite the growing interest in entropic time series and image analysis, there is a shortage of validated, open-source software tools that enable researchers to apply these methods. To date, packages for performing entropy analysis are often run using graphical user interfaces, lack the necessary supporting documentation, or do not include functions for more advanced entropy methods, such as cross-entropy, multiscale cross-entropy or bidimensional entropy. In light of this, this paper introduces EntropyHub, an open-source toolkit for performing entropic time series analysis in MATLAB, Python and Julia. EntropyHub (version 0.1) provides an extensive range of more than forty functions for estimating cross-, multiscale, multiscale cross-, and bidimensional entropy, each including a number of keyword arguments that allows the user to specify multiple parameters in the entropy calculation. Instructions for installation, descriptions of function syntax, and examples of use are fully detailed in the supporting documentation, available on the EntropyHub website– www.EntropyHub.xyz. Compatible with Windows, Mac and Linux operating systems, EntropyHub is hosted on GitHub, as well as the native package repository for MATLAB, Python and Julia, respectively. The goal of EntropyHub is to integrate the many established entropy methods into one complete resource, providing tools that make advanced entropic time series analysis straightforward and reproducible.

An Open-source Tool for Simplifying Computer and Assistive Technology Use: Tool for simplification and auto-personalization of computers and assistive technologies.

Computer access is increasingly critical for all aspects of life from education to employment to daily living, health and almost all types of participation. The pandemic has highlighted our dependence on technology, but the dependence existed before and is continuing after. Yet many face barriers due to disability, literacy, or digital literacy. Although the problems faced by individuals with disabilities have received focus for some time, the problems faced by people who just have difficulty in using technologies has not, but is a second large, yet less understood problem. Solutions exist but are often not installed, buried, hard to find, and difficult to understand and use. To address these problems, an open-source extension to the Windows and macOS operating systems has been under exploration and development by an international consortium of organizations, companies, and individuals. It combines auto-personalization, layering, and enhanced discovery, with the ability to Install on Demand (IoD) any assistive technologies a user needs. The software, called Morphic, is now installed on all of the computers across campus at several major universities and libraries in the US and Canada. It makes computers simpler to use, and allows whichever features or assistive technologies a person needs to appear on any computer they encounter (that has Morphic on it) and want to use at school, work, library, community center, etc. This demonstration will cover both the basic and advanced features as well as how to get free copies of the open-source software and configure it for school, work or personal use. It will also highlight lessons learned from the placements.

Forensic analysis of anti-forensic file-wiping tools on Windows.

This paper presents forensic analysis of anti-forensic file-wiping tools on the Windows platform. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. We also analyzed Registry keys and .lnk files to collect the evidence. Our experiments used four file-wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them. We also found that the contents of resident and non-resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.

Structural features of accounting automation application

The article discusses the behavior of the “1C platform: Enterprise 8” in different launch environments on devices running Unix, Windows, and Android operating systems. The load testing of the platform was carried out on the example of an application solution for automating the distribution of labor tasks of an organization to determine the optimal hardware and software part of user devices.

Analysis and information security assessment of the Windows operating system

Any application consists of many components (bases, frameworks, loaders), and errors in the component settings are liable to lead to various consequences. Even the smallest component can compromise the overall security of the application. It is acceptable to work quite effectively with event logs if one comprehends their formation principle. That is what the paper is devoted to. The material in the paper will be valuable for both information security specialists and ordinary users.

GP-SWAT (v1.0): a two-level graph-based parallel simulation tool for the SWAT model

Abstract. High-fidelity and large-scale hydrological models are increasingly used to investigate the impacts of human activities and climate change on water availability and quality. However, the detailed representations of real-world systems and processes contained in these models inevitably lead to prohibitively high execution times, ranging from minutes to days. Such models become computationally prohibitive or even infeasible when large iterative model simulations are involved. In this study, we propose a generic two-level (i.e., watershed- and subbasin-level) model parallelization schema to reduce the run time of computationally expensive model applications through a combination of model spatial decomposition and the graph-parallel Pregel algorithm. Taking the Soil and Water Assessment Tool (SWAT) as an example, we implemented a generic tool named GP-SWAT, enabling watershed-level and subbasin-level model parallelization on a Spark computer cluster. We then evaluated GP-SWAT in two sets of experiments to demonstrate the ability of GP-SWAT to accelerate single and iterative model simulations and to run in different environments. In each test set, GP-SWAT was applied for the parallel simulation of four synthetic hydrological models with different input/output (I/O) burdens. The single-model parallelization results showed that GP-SWAT can obtain a 2.3–5.8-times speedup. For multiple simulations with subbasin-level parallelization, GP-SWAT yielded a remarkable speedup of 8.34–27.03 times. In both cases, the speedup ratios increased with an increasing computation burden. The experimental results indicate that GP-SWAT can effectively solve the high-computational-demand problems of the SWAT model. In addition, as a scalable and flexible tool, it can be run in diverse environments, from a commodity computer running the Microsoft Windows operating system to a Spark cluster consisting of a large number of computational nodes. Moreover, it is possible to apply this generic tool to other subbasin-based hydrological models or even acyclic models in other domains to alleviate I/O demands and to optimize model computational performance.

Design and Implementation of Animation Virtual Battlefield Middleware Based on Artificial Intelligence

<p style="text-align: justify;"><span style="font-family: "times new roman";">The main research object of this paper is the design and implementation of artificial intelligence in the animated virtual battlefield, including three-dimensional stereo model, virtual reality technology and three-dimensional simulation. By analyzing traditional middleware technology and artificial intelligence algorithm, different templates of system functions are introduced. Finally, the simulation task was completed combined with the VR system, and the corresponding animation virtual battlefield middleware library was established under the Windows operating system to realize the comparison and verification results of the final model and the real picture.</span>

Computer Forensics and Examination of Digital Evidence on Windows Operating System

İnternet ve bilişim sistemleri üzerinde işlenen suçları tespit etmek amacıyla gerçekleştirilen adli bilişim incelemelerinin önemi, her geçen gün daha iyi anlaşılmaktadır. Bu minvalde suç ve suçlunun tespiti konusunda hukuka uygun dijital delillerin elde edilmesinin önemi çok büyüktür. Adli bilişim incelemelerinde, birçok farklı yöntem ile dijital deliller elde edilebilir. Özellikle bilişim sistemleri üzerinde kullanılan işletim sistemleri buna çok iyi bir örnektir. Küresel ölçekte olduğu gibi ülkemizde de gerek kişisel kullanımlarda gerekse kurumsal şirketlerde Windows işletim sistemi yaygın olarak kullanılmaktadır. Sanal dünya üzerinde işlenen suçların ve mağduriyetlerin çoğunluğu bu sistem üzerinde yaşanmaktadır. Bu nedenle çalışmada, Windows işletim sistemi üzerinde adli bilişim çalışması yapma gereksinimi duyulmuştur. Adli bilişim alanındaki güncel çalışmalar literatüre daha çok kavramsal ve hukuksal düzenleme olarak katkıda bulunmaktadır. Bu çalışmada ise metodolojik ve teknik analizler birlikte kullanılarak Windows PowerShell ve üçüncü parti yazılımlarla adli bilişim çalışması yapılması amaçlanmıştır. Böylece sistem bileşenleri üzerindeki dijital deliller, metedolojik ve teknik yöntemlerle analiz edilip, elde edilen sonuçlar görsel verilerle ortaya konulmuştur.

THE ATTACKING METHODS INVOLVED IN CURRENT TREND ENVIRONMENT

The use of Common Object Request Broker Architecture (CORBA) has become one of the answer to the requirement for interoperability among the rapidly increasing number of hardware and software products available nowadays. CORBA has been introduced as a mechanism in a distributed computing environment in order to overcome recent interoperability issue. This mechanism allows distributed objects to communicate with each other, whether operate on remote devices or local devices, written in different languages or platforms, or at different locations on a network. In this paper, the concept of CORBA application as a middleware is presented. In order to understand this concept, a simple program to handle auction sale. This system is developed using JAVA programming language. This application is implemented on Windows Operating System (OS) and its method is being invoked by a client from the other machine that also runs in Windows OS. Along with this, the benefits of CORBA and its limitation are discussed in this paper.Keywords—CORBA concept; client-server; benefits of Corba; Application example

Detection of Suspicious Timestamps in NTFS using Volume Shadow Copies

When a computer gets involved in a crime, it is the mission of the digital forensic experts to extract the left binary artifacts on that device. Among those artifacts, there may be some volume shadow copy files left on the Windows operating system. Those files are snapshots of the volume recorded by the system in case of a needed restore to a specific past date. Before this study, we did not know if the valuable forensic information hold within those snapshot files can be exploited to locate suspicious timestamps in an NTFS formatted partition. This study provides the reader with an inter-snapshot time analysis for detecting file system timestamp manipulation. In other words, we will leverage the presence of the time information within multiples volume shadow copies to detect any suspicious tampering of the file system timestamps. A detection algorithm of the suspicious timestamps is contributed. Its main role is to assist the digital investigator to spot the manipulation if it has occurred. In addition, a virtual environment has been set up to validate the use of the proposed algorithm for the detection.

MS_Piano: A Software Tool for Annotating Peaks in CID Tandem Mass Spectra of Peptides and N-Glycopeptides.

Annotating product ion peaks in tandem mass spectra is essential for evaluating spectral quality and validating peptide identification. This task is more complex for glycopeptides and is crucial for the confident determination of glycosylation sites in glycoproteins. MS_Piano (Mass Spectrum Peptide Annotation) software was developed for reliable annotation of peaks in collision induced dissociation (CID) tandem mass spectra of peptides or N-glycopeptides for given peptide sequences, charge states, and optional modifications. The program annotates each peak in high or low resolution spectra with possible product ion(s) and the mass difference between the measured and theoretical m/z values. Spectral quality is measured by two major parameters: the ratio between the sum of unannotated vs all peak intensities in the top 20 peaks, and the intensity of the highest unannotated peak. The product ions of peptides, glycans, and glycopeptides in spectra are labeled in different class-type colors to facilitate interpretation. MS_Piano assists validating peptide and N-glycopeptide identification from database and library searches and provides quality control and optimizes search reliability in custom developed peptide mass spectral libraries. The software is freely available in .exe and .dll formats for the Windows operating system.

JURNAL REVIEW: PERBANDINGAN SISTEM OPERASI LINUX DENGAN SISTEM OPERASI WINDOWS

Operating Systems are four components that must not be absent for Information Systems. For companies that have implemented a computerized system as part of the company's operational support, must pay attention to what Operating Systems are good for the company. Including the advantages and company budget for Information Technology. To get a good Operating System in accordance with office needs, a comparison of the Windows Operating System and Linux Operating System. The results of the comparison of these two Operating Systems can be input for deciding which Operating System is suitable for the company.

DEVELOPMENT OF A DEVICE FOR MEASURING AND ANALYZING VIBRATIONS

It is known that vibration is generated to one degree or another by all moving parts of machines. Vibration processes arising in the process of functioning of machines and equipment are highly informative, reflecting the technical condition of many parts and assemblies quite fully. Therefore, the use of vibration diagnostics systems makes it possible to determine a defect even at the stage of inception, thereby excluding emergency stops of machinery. An urgent task is to create a vibration analysis device, which consists of a sensor for measuring vibration, the principle of operation of which is based on the use of a direct piezoelectric effect. The output signal of the sensor will go to a personal computer or any other device with the Windows operating system, where a spectral analysis of the measured vibration signal is carried out using a Matlab-based diagnostic program.

Analysis of Digital Literacy in Biology Learning at SMAN 3 Batu Ampar

Background: Information technology has offered various conveniences in biology learning, students can learn more flexibly and are not hindered by the limitations of space and time, so it must be balanced with digital literacy. This study aims to determine the level of digital literacy of students in biology learning in class X SMAN 3 Batu Ampar. Method: This study used descriptive qualitative method. The research subjects were students of class X SMAN 3 Batu Ampar. Data collection techniques using indirect communication and observation. Collecting data using a questionnaire sheet and an observation sheet. The data analysis technique used is descriptive statistical analysis. Results: The results show that the level of digital literacy of students on the basic standard indicators of computer use is moderate (51%), while the basic internet standard indicators are moderate (50%), the basic standard indicators for the Windows operating system are low (43%), and the basic standard indicators for e-mail is low (48%). Conclusion: The level of digital literacy of class X students of SMAN 3 Batu Ampar in biology learning is classified as moderate. Despite the lack of facilities owned by some students, students have been able to use the internet to complete tasks in biology learning.