Comparison of Acquisition Software for Digital Forensics Purposes

Abstract

Digital Forensics, a term that is increasingly popular with internet needs and increasing cybercrime activity. Cybercrime is a criminal activity with digital media as a tool for committing crimes. The process for uncovering cybercrime is called digital forensics. The initial stage in digital forensics is an acquisition. The acquisition phase is very important because it will affect the level of difficulty and ease in investigating cybercrime. Software acquisition will affect the abandoned artefacts and even overwrite important evidence by the software, therefore investigators must use the best software for the acquisition stage. This study shows the difference in software for the acquisition of the best Random Access Memory (RAM) such as processing time, memory usage, registry key, DLL. This research presents five acquisition software such as FTK Imager, Belkasoft RAM Capturer, Memoryze, DumpIt, Magnet RAM Capturer. Results of this study showed that FTK Imager left about 10 times more artefacts than DumpIt and Memoryze. Magnet RAM Capture the most artefacts, 4 times more than Belkasot RAM Capturer. Software acquisition with many artefacts, namely Capture RAM Magnet and FTK Imager, while for the fastest time is DumpIt and Capture RAM Magnet for software that takes a long time.

The Influence of Virtual Secure Mode (VSM) on Memory Acquisition

“…A study in [12] compared four tools, namely Windows Memory Reader, Belkasoft"s Live Ram Capturer, ProDiscover, and FTK Imager, to examine their performance in capturing memory including their ease of use. Another study in [13] showed the differences in processing time, memory usage, registry key, and DLL for FTK Imager, Belkasoft RAM Capturer, Memoryze, DumpIt, and Magnet RAM Capturer. Similarly, [14] also examined how the combination of Belkasoft RAM Capturer, FTK Imager, and Winhex can be utilized to obtain data for the Line app in Windows 8.1.…”

Review Tools Web Browser Forensics untuk Mendukung Pencarian Bukti Digital

“…Setiap tahun selalu meningkat baik dari sisi jumlahnya maupun variasi kejahatannya. Internet dahulu hanya untuk mengirimkan email saja, tetapi sekarang internet telah digunakan diberbagai aktivitas pekerjaan dan kehidupan manusia seperti mengirim gambar, video, data dapat dikirimkan dengan mudah dan cepat [2]. Kejahatan di internet muncul karena adanya komunikasi dan hubungan antara satu komputer dengan komputer yang lain melalui suatu jaringan [3].…”

Comparative Analysis of Cloning-Hashing Applications for Securing Digital Evidence

“…People often use different digital media like PCs, PDAs, laptops, cell phones, and some other digital devices and use them for communication purposes. One of the main sources of communication is the internet, the internet itself can cause several crimes or better known as cybercrimes, which result in damage such as data theft or dangerous system activities [2]. The people who have the responsibility to commit such cybercrimes are required for their capabilities and procedures to prevent or carry out such attacks [3].…”