2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)最新文献

筛选

英文中文

CAT Record (computer activity timeline record): A unified agent based approach for real time computer forensic evidence collection CAT记录(计算机活动时间线记录):一种基于统一代理的实时计算机取证方法

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911539

Shadi Al Awawdeh, I. Baggili, A. Marrington, Farkhund Iqbal

{"title":"CAT Record (computer activity timeline record): A unified agent based approach for real time computer forensic evidence collection","authors":"Shadi Al Awawdeh, I. Baggili, A. Marrington, Farkhund Iqbal","doi":"10.1109/SADFE.2013.6911539","DOIUrl":"https://doi.org/10.1109/SADFE.2013.6911539","url":null,"abstract":"In this paper we present CAT Record - a real time computer forensics agent that records computer activity for subsequent forensic investigation on a Windows computer system as actions are taking place on a system. This approach is different from the traditional post-mortem approach of examining a hard disk since activities are being recorded as they are happening. The prototype agent included six modules 1) Windows Event Watcher - which records the Windows Operating System events 2) Active Window Detector - which records the active windows on the screen 3) Font-Time-Power-Resolution Detector - which records changes in font, time, power or resolution on the system 4) Explorers Monitor - which records the activity when opening an item from the Windows Explorer or Internet Explorer 5) Removable Devices Detector - which records any external devices that are plugged in or removed from a system and 6) File System Watcher - which records the activity taking place on the file system. CAT Record was stress tested in three scenarios using an automated program that was written to test the accuracy of the agent and its memory consumption on Windows XP and Windows 7. Overall, the results indicated that the amount of recorded data varied between Windows XP and Windows 7 and that CAT Record on average did not consume more than 42,876 KB of memory per second during its operation under extremely stressful tests.","PeriodicalId":287131,"journal":{"name":"2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126946450","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Digital forensic investigation in cloud computing environment: Impact on privacy 云计算环境下的数字取证调查:对隐私的影响

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911542

Filipo Sharevski

引用次数: 9

A study of forensic & analysis tools 法医和分析工具的研究

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911540

S. Raghavan, S. Raghavan

引用次数: 12

首页上一页