Correctness, atomicity, and integrity: Defining criteria for forensically-sound memory acquisition

Vömel, Stefan; Freiling, Felix C.

doi:10.1016/j.diin.2012.04.005

Cited by 40 publications

(11 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Event Sequentiality Property Being e a (sending) and e b (receiving), two sequential DML events recorded in their corresponding audit records; then, the timestamp T s of e a must be less than the timestamp value Definition II.10. Event Concurrency Property Since concurrency explains the occurrence of DML events that are not affected by a "happen-before" relation [24], they can be defined in a more general perspective as they are not restricted by a timestamp condition.…”

Section: Event Causalitymentioning

confidence: 99%

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

Flores

Jhumka

2017

2017 IEEE Trustcom/BigDataSE/Icess

View full text Add to dashboard Cite

Section: Event Causalitymentioning

confidence: 99%

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

Flores

Jhumka

2017

2017 IEEE Trustcom/BigDataSE/Icess

View full text Add to dashboard Cite

“…However, there are studies (Kangarlou et al, 2009;Bloom, 1970;Vomel & Freiling, 2012) that have been discussed because of the importance of technology in understanding the literature. In this section, the mind map has been divided into two.…”

Section: Mind Mapmentioning

confidence: 99%

“…Identification is defined in terms of whether the researchers identify the target digital forensics requirements they are trying to achieve. These requirements include evidence integrity, consistency and correctness (Vomel & Freiling, 2012). Another challenge is to collect, examine and reconstruct evidence from cloud based services.…”

Section: Dimension Iii: Forensics-procedural-basedmentioning

confidence: 99%

A State-Of-The-Art Review of Cloud Forensics

Almulla

Iraqi

Jones

2014

JDFSL

View full text Add to dashboard Cite

Cloud computing and digital forensics are emerging fields of technology. Unlike traditional digital forensics where the target environment can be almost completely isolated, acquired and can be under the investigators control; in cloud environments, the distribution of computation and storage poses unique and complex challenges to the investigators. Recently, the term "cloud forensics" has an increasing presence in the field of digital forensics. In this state-of-the-art review, we included the most recent research efforts that used "cloud forensics" as a keyword and then classify the literature into three dimensions: (1) survey-based, (2) technology-based and (3) forensics-procedural-based. We discuss widely accepted standard bodies and their efforts to address the current trend of cloud forensics. Our aim is not only to reference related work based on the discussed dimensions, but also to analyse them and generate a mind map that will help in identifying research gaps. Finally, we summarize existing digital forensics tools and the available simulation environments that can be used for evidence acquisition, examination and cloud forensics test purposes.

show abstract

“…As such, memory acquisition, represents a critical step for the implementation of a real-time FMA-based solution. Furthermore, the soundness of the acquisition process is another serious concern [30].…”

Section: Architecturementioning

confidence: 99%

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Pietro¹,

Franzoni²,

Lombardi³

2017

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Abstract-Effectively protecting the Windows OS is a challenging task, since most implementation details are not publicly known. Windows has always been the main target of malwares that have exploited numerous bugs and vulnerabilities. Recent trusted boot and additional integrity checks have rendered the Windows OS less vulnerable to kernel-level rootkits. Nevertheless, guest Windows Virtual Machines are becoming an increasingly interesting attack target. In this work we introduce and analyze a novel Hypervisor-Based Introspection System (HyBIS) we developed for protecting Windows OSes from malware and rootkits. The HyBIS architecture is motivated and detailed, while targeted experimental results show its effectiveness. Comparison with related work highlights main HyBIS advantages such as: effective semantic introspection, support for 64-bit architectures and for latest Windows (8.x and 10), advanced malware disabling capabilities. We believe the research effort reported here will pave the way to further advances in the security of Windows OSes.

show abstract

Correctness, atomicity, and integrity: Defining criteria for forensically-sound memory acquisition

Cited by 40 publications

References 20 publications

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

Implementing Chain of Custody Requirements in Database Audit Records for Forensic Purposes

A State-Of-The-Art Review of Cloud Forensics

HyBIS: Advanced Introspection for Effective Windows Guest Protection

Contact Info

Product

Resources

About