Forensic Analysis of Windows Server 2008 Physical Memory |
Author(s): |
| Harish Kumar , Graphic Era University, Dehradun; Parry Gowher Majeed, Graphic Era University, Dehradun.; Sumit Pundir, Graphic Era University, Dehradun |
Keywords: |
| Digital Investigation, Windows memory forensics, Computer Forensics. System State, |
Abstract |
|
Due to the advancement of information technology and its ease of use, cyber-crime prevention demands serious attention. Physical memory forensics is relatively new field, wherein methods and techniques for collection, analysis and documentation of cybercrime activity evidences are studied. It has gradually moved into the focus of forensic investigator and researchers. To investigate any illegal activity on computer system, in most of the cases, sensitive information such as username, password and typed commands can only be found in physical memory. This paper explores a method based on search of sensitive information from different windows system states such as sleep state, logoff state, soft and hard reboot, for forensic analysis of Windows Server 2008 physical memory. The experiments were carried out in a virtual environment consisting of Windows Server 2008 operating system. |
Other Details |
|
Paper ID: IJSRDV2I1306 Published in: Volume : 2, Issue : 1 Publication Date: 01/04/2014 Page(s): 691-694 |
Article Preview |
|
|
|
|
