Advanced internet technologies providing services like e-mail, social networking, online banking, online shopping etc., have made day-to-day activities simple and convenient. Increasing dependency on the internet, convenience, and decreasing cost of electronic devices have resulted in frequent use of online services. However, increased indulgence over the internet has also accelerated the pace of digital crimes. The increase in number and complexity of digital crimes has caught the attention of forensic investigators. The Digital Investigators are faced with the challenge of gathering accurate digital evidence from as many sources as possible. In this paper, an attempt was made to recover digital evidence from a system's RAM in the form of information about the most recent browsing session of the user. Four different applications were chosen and the experiment was conducted across two browsers. It was found that crucial information about the target user such as, user name, passwords, etc., was recoverable.

No abstract

There has been a surge towards physical memory forensics with recent development of valuable tools and techniques in acquisition and analysis. However, most of the research is skewed towards the Operating System architecture with primary focus on processes, threads, kernel modules etc. There has been little research towards retrieval of application level data. Moreover, the research is majorly application specific and keyword search oriented, involving text string search tools which use match and/or indexing algorithms to search digital evidence. Our paper aims to unearth application level data through a generic approach and provide some degree of automation to reduce the string search dependency. The paper revolves around the web browser and the HTTP protocol which are the basic elements of the interface between a user and the internet. Programs have been developed for the extraction of HTTP message headers from the acquired RAM image and a detailed analysis of how the information in these headers is crucial, follows.