Characterizing data structures for volatile forensics

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Volatile memory forensic tools can extract valuable evidence from latent data structures present in memory dumps. However, current techniques are generally limited by a lack of understanding of the underlying data without the use of expert knowledge. In this paper, we characterize the nature of such evidence by using deep analysis techniques to better understand the life-cycle and recoverability of latent program data in memory. We have developed Cafegrind, a tool that can systematically build an object map and track the use of data structures as a program is running. Statistics collected by our tool can show which data structures are the most numerous, which structures are the most frequently accessed and provide summary statistics to guide forensic analysts in the evidence gathering process. As programs grow increasingly complex and numerous, the ability to pinpoint specific evidence in memory dumps will be increasingly helpful. Cafegrind has been tested on a number of real-world applications and we have shown that it can successfully map up to 96% of heap accesses.

Original languageEnglish (US)
Title of host publication2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011
DOIs
StatePublished - Dec 1 2011
Event2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011 - Berkeley/Oakland, CA, United States
Duration: May 26 2011May 26 2011

Publication series

Name2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011

Other

Other2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011
CountryUnited States
CityBerkeley/Oakland, CA
Period5/26/115/26/11

    Fingerprint

ASJC Scopus subject areas

  • Information Systems and Management

Cite this

Chan, E., Venkataraman, S., Tkach, N., Larson, K., Gutierrez, A., & Campbell, R. H. (2011). Characterizing data structures for volatile forensics. In 2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011 [6159126] (2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011). https://doi.org/10.1109/SADFE.2011.5