Journal & Conference Proceeding Publications

ID Code : CSC 0021
Title : Hybrid Approach for Memory Analysis in Windows System
Author/s : Khairul Akram Zainol Ariffin
Ahmad Kamil Mahmood
Jafreezal Jaafar
Solahuddin Shamsuddin
Abstract : Random Access Memory (RAM) is an important device in computer system. It can represent the snapshot on how the computer has been used by the user. With the growth of its importance, the computer memory has been an issue that has been discussed in digital forensics. A number of tools have been developed to retrieve the information from the memory. However, most of the tools have their limitation in the ability of retrieving the important information from the computer memory. Hence, this paper is aimed to discuss the limitation and the setback for two main techniques such as process signature search and process enumeration. Then, a new hybrid approach will be presented to minimize the setback in both individual techniques. This new approach combines both techniques with the purpose to retrieve the information from the process block and other objects in the computer memory. Nevertheless, the basic theory in address translation for x86 platforms will be demonstrated in this paper.
Publication : International Conference on Electrical, Computer, Electronics and Communication Engineering
Year Published : 2012|926-934|Conference Proceeding
PDF / Official URL :