search menu icon-carat-right cmu-wordmark

Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis

Technical Note
The authors compare various approaches and tools used to capture and analyze evidence from computer memory.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2008-TN-017
DOI (Digital Object Identifier)
10.1184/R1/6572696.v1

Abstract

People responsible for computer security incident response and digital forensic examination need to continually update their skills, tools, and knowledge to keep pace with changing technology. No longer able to simply unplug a computer and evaluate it later, examiners must know how to capture an image of the running memory and perform volatile memory analysis using various tools, such as PsList, ListDLLs, Handle, Netstat, FPort, Userdump, Strings, and PSLoggedOn. This paper presents a live response scenario and compares various approaches and tools used to capture and analyze evidence from computer memory.

Cite This Technical Note

Waits, C., Akinyele, J., Nolan, R., & Rogers, L. (2008, August 1). Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis. (Technical Note CMU/SEI-2008-TN-017). Retrieved June 17, 2024, from https://doi.org/10.1184/R1/6572696.v1.

@techreport{waits_2008,
author={Waits, Cal and Akinyele, Joseph and Nolan, Richard and Rogers, Lawrence},
title={Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis},
month={Aug},
year={2008},
number={CMU/SEI-2008-TN-017},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6572696.v1},
note={Accessed: 2024-Jun-17}
}

Waits, Cal, Joseph Akinyele, Richard Nolan, and Lawrence Rogers. "Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis." (CMU/SEI-2008-TN-017). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, August 1, 2008. https://doi.org/10.1184/R1/6572696.v1.

C. Waits, J. Akinyele, R. Nolan, and L. Rogers, "Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2008-TN-017, 1-Aug-2008 [Online]. Available: https://doi.org/10.1184/R1/6572696.v1. [Accessed: 17-Jun-2024].

Waits, Cal, Joseph Akinyele, Richard Nolan, and Lawrence Rogers. "Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis." (Technical Note CMU/SEI-2008-TN-017). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Aug. 2008. https://doi.org/10.1184/R1/6572696.v1. Accessed 17 Jun. 2024.

Waits, Cal; Akinyele, Joseph; Nolan, Richard; & Rogers, Lawrence. Computer Forensics: Results of Live Response Inquiry vs. Memory Image Analysis. CMU/SEI-2008-TN-017. Software Engineering Institute. 2008. https://doi.org/10.1184/R1/6572696.v1