Forensic Analysis of Physical Memory and Page File
Year: 2009
Type: dissertation
Abstract: With the passage of time, the field of computer forensics is maturing and the traditional\nmethodology of disk forensics has now become a standard. In the same manner\nvolatile data forensics is also getting serious attention from forensic investigators and\nresearchers. Physical memory is an integral part of volatile data forensics. It can provide\na forensic examiner with wealth of information like passwords, encrypted keys, typed\ncommands, web addresses, shared and executable files, currently running processes and\nterminated processes, open ports and active connections. This thesis explores the forensic\nanalysis of physical memory and page file in search of sensitive data using the currently\navailable tools. Experiments are carried out in virtual environment on Windows XP operating\nsystem. The immediate purpose of this thesis is to study the impact of increased\nmemory size, operating system and applications on the retention of sensitive data in today’s\ncomputers. We will also explore the capabilities and limitations of the currently\navailable tools for the acquisition and analysis of memory and page file.
Author: Hameed Iqbal
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W2469994378