FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory

Petroni, Nick L.; Walters, Aaron; Fraser, Timothy; Arbaugh, William A.

doi:10.1016/j.diin.2006.10.001

Cited by 101 publications

(40 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The paper also describes a compelling attack that modifies cached registry and proposes a method to detect such attacks by examining memory. Petroni et al [161] propose the FATKit, an extendable framework for extraction and analysis of volatile system memory. Harms [94] investigates system restore points in Windows XP and Arasteh and Debbabi [8] use the process logic to model extracted properties of memory stack and verify against model generated from program assembly code.…”

Section: Digital Timestamps and Time-liningmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

Section: Digital Timestamps and Time-liningmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

show abstract

“…Prior work identifies data structures in memory by traversing pointers starting from program (kernel) global variables and following the points-to relationships to reach instances of the data structure. KOP [5], MAS [16], FATKIT [1] and VOLATILITY [3] all use such technique. While SIGPATH also leverages this approach the substantial difference is that these works require access to the target's source code or its data structure definitions in symbol files.…”

Section: Related Workmentioning

confidence: 99%

“…These data structures store private, often sensitive, data of interest such as running processes in an OS, unit and resource information in online games, and credentials and contact information in Instant Messengers (IM). Such capability is crucial for memory forensics [1][2][3][4], rootkit detection [5][6][7], game hacking [8], reverse engineering [9][10][11], and virtual machine introspection (VMI) [12].…”

Section: Introductionmentioning

confidence: 99%

SigPath: A Memory Graph Based Approach for Program Data Introspection and Modification

Urbina

Caballero

et al. 2014

Computer Security - ESORICS 2014

View full text Add to dashboard Cite

Abstract. Examining and modifying data of interest in the memory of a target program is an important capability for security applications such as memory forensics, rootkit detection, game hacking, and virtual machine introspection. In this paper we present a novel memory graph based approach for program data introspection and modification, which does not require source code, debugging symbols, or any API in the target program. It takes as input a sequence of memory snapshots taken while the program executes, and produces a path signature, which can be used in different executions of the program to efficiently locate and traverse the in-memory data structures where the data of interest is stored. We have implemented our approach in a tool called SIGPATH. We have applied SIG-PATH to game hacking, building cheats for 10 popular real-time and turn-based games, and for memory forensics, recovering from snapshots the contacts a user has stored in four IM applications including Skype and Yahoo Messenger.

show abstract

“…Recent work [4] has considered digital forensics as a primary VMI application area, and there has also been associated work in tools that construct forensically relevant information from memory images [5,6].…”

Section: Research Questionsmentioning

confidence: 99%

Investigating the Implications of Virtual Machine Introspection for Digital Forensics

Nance

Bishop

Hay

2009

2009 International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-Researchers and practitioners in computer forensics currently must base their analysis on information that is either incomplete or produced by tools that may themselves be compromised as a result of the intrusion. Complicating these issues are the techniques employed by the investigators themselves. If the system is quiescent when examined, most of the information in memory has been lost. If the system is active, the kernel and programs used by the forensic investigators are likely to influence the results and as such are themselves suspect. Using virtual machines and a technique called virtual machine introspection can help overcome these limits, but it introduces its own research challenges. Recent developments in virtual machine introspection have led to the identification of four initial priority research areas in virtual machine introspection including virtual machine introspection tool development, applications of virtual machine introspection to non-quiescent virtual machines, virtual machine introspection covert operations, and virtual machine introspection detection.

show abstract

FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory

Cited by 101 publications

References 6 publications

Digital forensic research: current state of the art

Digital forensic research: current state of the art

SigPath: A Memory Graph Based Approach for Program Data Introspection and Modification

Investigating the Implications of Virtual Machine Introspection for Digital Forensics

Contact Info

Product

Resources

About