Accession Number:

AD1053832

Title:

Whitelisting System State In Windows Forensic Memory Visualizations

Descriptive Note:

Technical Report,01 May 2014,24 Mar 2016

Corporate Author:

AIR FORCE INSTITUTE OF TECHNOLOGY WRIGHT-PATTERSON AFB OH WRIGHT-PATTERSON AFB United States

Personal Author(s):

Report Date:

2016-03-24

Pagination or Media Count:

120.0

Abstract:

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. The most pressing challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide primarily text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and local detailed data within a single page application. A novel whitelisting feature further improves analysis by eliminating items of little interest from view, allowing examiners to identify artifacts more quickly and accurately. Results from two pilot studies demonstrates that the visualization tool can assist examiners to more accurately and quickly identify artifacts of interest.

Subject Categories:

  • Computer Systems Management and Standards
  • Computer Programming and Software

Distribution Statement:

APPROVED FOR PUBLIC RELEASE