Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis
People responsible for computer security incident response and digital forensic examination need to continually update their skills, tools, and knowledge to keep pace with changing technology. No longer able to simply unplug a computer and evaluate it later, examiners must know how to capture an image of the running memory and perform volatile memory analysis using various tools, such as PsList, ListDLLs, Handle, Netstat, FPort, Userdump, Strings, and PSLoggedOn. This paper presents a live response scenario and compares various approaches and tools used to capture and analyze evidence from computer memory.
This report is related to the following area(s) of work:
Digital Intelligence and ForensicsSecurity and Survivability
Technical Note
CMU/SEI-2008-TN-017
August 2008
Cite This Report
SEI:
Waits, Cal; Akinyele, Joseph; Nolan, Richard; & Rogers, Lawrence. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Software Engineering Institute, Carnegie Mellon University, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm
IEEE:
C. Waits, J. Akinyele, R. Nolan, and L. Rogers, "Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2008-TN-017, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm
APA:
Waits, C., Akinyele, J., Nolan, R., & Rogers, L. (2008). Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Retrieved May 22, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm
CHI:
Waits, Cal, Joseph Akinyele, Richard Nolan, and Lawrence Rogers. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (CMU/SEI-2008-TN-017). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2008. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm
MLA:
Waits, C., Akinyele, J., Nolan, R., & Rogers, L. 2008. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis (Technical Report CMU/SEI-2008-TN-017). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfm
Find Us Here
Share This Page
For more information
