Accession Number:

ADA488423

Title:

Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis

Descriptive Note:

Technical note

Corporate Author:

CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST

Report Date:

2008-08-01

Pagination or Media Count:

31.0

Abstract:

People responsible for computer security incident response and digital forensic examination need to continually update their skills, tools, and knowledge to keep pace with changing technology. No longer able to simply unplug a computer and evaluate it later, examiners must know how to capture an image of the running memory and perform volatile memory analysis using various tools, such as PsList, ListDLLs, Handle, Netstat, FPort, Userdump, Strings, and PSLoggedOn. This paper presents a live response scenario and compares various approaches and tools used to capture and analyze evidence from computer memory.

Subject Categories:

  • Medicine and Medical Research
  • Computer Programming and Software

Distribution Statement:

APPROVED FOR PUBLIC RELEASE