Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis

People responsible for computer security incident response and digital forensic examination need to continually update their skills, tools, and knowledge to keep pace with changing technology. No longer able to simply unplug a computer and evaluate it later, examiners must know how to capture an image of the running memory and perform volatile memory analysis using various tools, such as PsList, ListDLLs, Handle, Netstat, FPort, Userdump, Strings, and PSLoggedOn. This paper presents a live response scenario and compares various approaches and tools used to capture and analyze evidence from computer memory.

PDF [750 KB]

Authors

Cal Waits

Joseph A. Akinyele

Richard Nolan

Larry Rogers

This report is related to the following area(s) of work:

Digital Intelligence and Forensics
Security and Survivability

Technical Note
CMU/SEI-2008-TN-017
August 2008

Cite This Report

SEI:

Waits, Cal; Akinyele, Joseph; Nolan, Richard; & Rogers, Lawrence. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Software Engineering Institute, Carnegie Mellon University, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm

IEEE:

C. Waits, J. Akinyele, R. Nolan, and L. Rogers, "Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2008-TN-017, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm

APA:

Waits, C., Akinyele, J., Nolan, R., & Rogers, L. (2008). Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Retrieved May 22, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm

CHI:

Waits, Cal, Joseph Akinyele, Richard Nolan, and Lawrence Rogers. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm

MLA:

Waits, C., Akinyele, J., Nolan, R., & Rogers, L. 2008. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (Technical Report CMU/SEI-2008-TN-017). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm

Find Us Here

Find us on Youtube  Find us on LinkedIn  Find us on twitter  Find us on Facebook

Share This Page

Share on Facebook  Send to your Twitter page  Save to del.ico.us  Save to LinkedIn  Digg this  Stumble this page.  Add to Technorati favorites  Save this page on your Google Home Page 

For more information

Contact Us

info@sei.cmu.edu

412-268-5800

Help us improve

Visitor feedback helps us continually improve our site.

Please tell us what you
think with this short
(< 5 minute) survey.