Memory Analysis Publications

Modern Windows Hibernation File Analysis

Full Text Modern Windows Hibernation File Analysis, Digital Investigation 2016 Abstract This paper presents the first analysis of the new hibernation file format that is used in Windows versions 8, 8.1, and 10. We also discuss several changes in the hibernation and shutdown behavior of Windows that will have a direct impact on digital forensic […]

Memory Analysis Publications

Pool Tag Quick Scanning for Windows Memory Analysis

Full Text Pool Tag Quick Scanning for Windows Memory Analysis, DFRWS Europe 2016 Abstract Pool tag scanning is a process commonly used in memory analysis in order to locate kernel object allocations, enabling investigators to discover evidence of artifacts that may have been freed or otherwise maliciously hidden from the operating system. The fastest current […]

Publications

Android Memory Capture and Applications for Security and Privacy

Full Text Android Memory Capture and Applications for Security and Privacy, University of New Orleans 2011 Abstract The Android operating system is quickly becoming the most popular platform for mobile devices. As Android’s use increases, so does the need for both forensic and privacy tools designed for the platform. This thesis presents the first methodology […]

Publications

Acquisition and Analysis of Volatile Memory from Android Devices

Full Text Acquisition and Analysis of Volatile Memory from Android Devices, Digital Investigation Journal, 2012 Abstract The Android operating system for mobile phones, which is still relatively new, is rapidly gaining market share, with dozens of smartphones and tablets either released or set to be released. In this paper, we present the first methodology and […]

Publications

Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations

Full Text Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations, University of New Orleans 2009 Abstract Digital forensics is the science concerned with discovering, preserving, and analyzing evidence on digital devices. The intent is to be able to determine what events have taken place, when they occurred, who performed them, and how they […]

Publications

MMR: A Platform for Large-Scale Forensic Computing

Full Text MMR: A Platform for Large-Scale Forensic Computing, IFIP 2009 Abstract The timely processing of large-scale digital forensic targets demands the empoyment of large-scale distributed resources, as well as the flexibility to customize the processing performed on the target. We presentMMR– a new, open implementation of the MapReduce processing model, which significantly outperforms prior […]

Publications

Dynamic Recreation of Kernel Data Structures for Live Forensics

Full Text Dynamic Recreation of Kernel Data Structures for Live Forensics, DFRWS 2010 Abstract The role of live forensics in digital forensic investigations has become vital due to the importance of volatile data such as encryption keys, network activity, currently running processes, in memory only malware, and other key pieces of data that are lost […]

Publications

Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation

Full Text Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation, DFRWS 2010 Abstract This paper presents the first deep investigation of the kmem_cache facility in Linux from a forensics perspective. The kmem_cache is used by the Linux kernel to quickly allocate and deallocate kernel structures associated with processes, files, and the network stack. […]

Publications

FACE: Automated Digital Evidence Discovery and Correlation

Full Text FACE: Automated Digital Evidence Discovery and Correlation, DFRWS 2008 Abstract Digital forensic tools are being developed at a brisk pace in response to the ever increasing variety of forensic targets. Most tools are created for specific tasks–file system analysis, memory analysis, network analysis, etc.–and make little effort to inter-operate with one another. This […]

Publications

Hash-based Classification of Data: Class-based Similarity Hashing

Full Text Hash-based Classification of Data: Class-based Similarity Hashing, IFIP 2008 Abstract In this paper, we introduce the notion of class-aware similarity hashes, or classprints which is an outgrowth of recent work on similarity hashing. Specifically, we build on the notion of context-based hashing to design a framework both for identifying data type based on […]