In-Depth Analysis of Computer Memory Acquisition Software for Forensic Purposes
-
-
[1] Sam Houston State University
Sam Houston State University
Estados Unidos
-
- Localización: Journal of forensic sciences, ISSN-e 1556-4029, ISSN 0022-1198, Vol. 61, Nº. Extra 1, 2016, págs. 110-116
- Idioma: inglés
- Texto completo no disponible (Saber más ...)
-
Resumen
The comparison studies on random access memory (RAM) acquisition tools are either limited in metrics or the selected tools were designed to be executed in older operating systems. Therefore, this study evaluates widely used seven shareware or freeware/open source RAM acquisition forensic tools that are compatible to work with the latest 64-bit Windows operating systems. These tools’ user interface capabilities, platform limitations, reporting capabilities, total execution time, shared and proprietary DLLs, modified registry keys, and invoked files during processing were compared. We observed that Windows Memory Reader and Belkasoft’s Live Ram Capturer leaves the least fingerprints in memory when loaded. On the other hand, ProDiscover and FTK Imager perform poor in memory usage, processing time, DLL usage, and not-wanted artifacts introduced to the system. While Belkasoft’s Live Ram Capturer is the fastest to obtain an image of the memory, Pro Dis- cover takes the longest time to do the same job
