Live Forensics Analysis of Line App on Proprietary Operating System

Riadi, Imam; Sunardi, Sunardi; Rauli, Muhamad Ermansyah

doi:10.22219/kinetik.v4i4.850

Cited by 8 publications

(15 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Penelitian dengan metode live forensic dilakukan oleh ) dengan judul Identifikasi Bukti Digital WhatsApp pada Sistem Operasi Proprietary Menggunakan Live Forensics, penelitian ini menghasilkan barang bukti terkait kasus penipuan online dengan menggunakan tool ftk imager. Peneliti mengambil dan menganalisis data pada RAM, berupa percakapan WhatsApp (Riadi et al, 2019) Kerangka kerja dalam penyusunan laporan investigasi suatu kasus dapat dilakukan dengan beberapa metode, diantaranya menggunakan metode National Institute of Justice (NIJ) dan National Institute of Standard Technology (NIST). Penelitian dengan metode NIJ dilakukan oleh (Riadi et al, n.d.) (Riadi, Yudhana, et al, 2018).…”

Section: Gambar 2 Rangkuman Persentase Serangan Siberunclassified

Analisis Bukti Serangan Address Resolution Protocol Spoofing menggunakan Metode National Institute of Standard Technology

2020

Self Cite

View full text Add to dashboard Cite

Penelitian ini bertujuan untuk menemukan informasi bukti serangan Address Resolution Protocol (ARP) Spoofing berupa alamat MAC address penyerang dan korban beserta waktu terjadinya serangan. Penelitian ini menggunakan tools wireshark untuk melihat lalu lintas jaringan, terutama pada protokol ARP dan menggunakan metode National Insitute of Standard Technology (NIST) sebagai kerangka kerja selama proses simulasi sampai dengan pembuatan laporan barang bukti. Serangan ARP Spoofing dapat mengakibatkan terjadinya serangan lain, seperti Denial of Service dan Man in The Middle Attack, yanag mana serangan ini memungkinkan pengguna tidak dapat mengakses kedalam jaringan dan terjadinya pencurian data. Pada tahapan simulasi dilakukan 2 serangan ARP Spoofing terhadap 1 perangkat laptop dan 1 perangkat routerboard yang terhubung didalam jaringan. Hasil dari simulasi serangan berhasil ditemukan 2 serangan beserta informasi yang berhasil diperoleh, yaitu alamat MAC address penyerang dan korban beserta waktu terjadinya serangan. Berdasarkan hasil pengujian yang dilakukan, berhasil ditemukan semua serangan ARP Spoofing yang terjadi pada jaringan dengan tingkat keberhasilan 100%.

show abstract

Section: Gambar 2 Rangkuman Persentase Serangan Siberunclassified

Analisis Bukti Serangan Address Resolution Protocol Spoofing menggunakan Metode National Institute of Standard Technology

2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…Still, on the other hand, some parties are not responsible for using Metasploit to carry out illegal hacking [3] [4]. On a computer, there is a Random Access Memory (RAM) in which there is a lot of data and information related to the processes running on a computer [5] [6].…”

Section: Introductionmentioning

confidence: 99%

“…Digital forensics processes need to be carried out to expose these crimes. Digital forensics is a science that aims to obtain evidence related to criminal cases and can be accounted for before the law [5][9] [10].…”

Section: Introductionmentioning

confidence: 99%

“…Other research on RAM extraction in Windows 7 was conducted by Thomas, et al The research explained the methodology for listing running processes, loading DLLs, and extracting memory processes from running processes [21]. In addition, Riadi, et al explored RAM forensics using Live forensic techniques in chat line applications on the Windows 8.1 operating system with online shop fraud cases [5].…”

mentioning

confidence: 99%

See 1 more Smart Citation

Detection of Metasploit Attacks Using RAM Forensic on Proprietary Operating Systems

Prakoso

Riadi

Prayudi

2020

KINETIK

Self Cite

View full text Add to dashboard Cite

Information technology has become an essential thing in the digital era as it is today. With the support of computer networks, information technology is used as a medium for exchanging data and information. Much information is confidential. Therefore, security is also essential. Metasploit is one of the frameworks commonly used by penetration testers to audit or test the security of a computer system legally, but it does not rule out the possibility that Metasploit can also be used for crime. For this reason, it is necessary to carry out a digital forensic process to uncover these crimes. In this study, a simulation of attacks on Windows 10 will be carried out with Metasploit. Then the digital forensics process uses live forensics techniques on computer RAM, where the computer RAM contains information about the processes running on the computer. The live forensic technique is important because information on RAM will be lost if the computer is off. This research will use FTK Imager, Dumpit, and Magnet RAM Capture as the RAM acquisition tool and Volatility as the analysis tool. The results of the research have successfully shown that the live forensics technique in RAM is able to obtain digital evidence in the form of an attacker's IP, evidence of exploits/Trojans, processes running on RAM, operating system profiles used and the location of the exploits/Trojan when executed by the victim.

show abstract

“…Live forensics technique will be able to improve the results of digital evidence data recovery from the TRIM function on the NVMe SSD. This technique can also guarantee the data integrity without losing the digital evidence [14] [15].…”

mentioning

confidence: 99%

Live Forensics Method for Acquisition on the Solid State Drive (SSD) NVMe TRIM Function

Pranoto

Riadi

Prayudi

2020

KINETIK

Self Cite

View full text Add to dashboard Cite

SSD currently has a new storage media technology namely Solid State Drive Non-volatile Memory Express (SSD NVMe). In addition, SSD has a feature called TRIM. The TRIM feature allows the operating system to tell SSDs which blocks are not used. TRIM removes blocks that have been marked for removal by the operating system. However, the TRIM function has a negative effect for the digital forensics specifically related to data recovery. This study aimed to compare the TRIM disable and enable functions to determine the ability of forensics tools and recovery tools to restore digital evidence on the NVMe SSD TRIM function. The operating system used in this study was Windows 10 professional with NTFS file system. Typically, acquisition is conducted by using traditional or static techniques. Therefore, there was a need of a technique to acquire SSD by using the live forensics method without shutting down the running operating system. The live forensics method was applied to acquire SSD NVMe directly to the TRIM disable and enable functions. The tools used for live acquisition and recovery were FTK Imager Portable. The inspection and analysis phases used Sleutkit Autopsy and Belkasoft Evidence Center. This research found that in the recovery process of TRIM disabled and enabled, TRIM disabled could find evidence while maintaining the integrity of evidence. It was indicated by the same hash value of the original file and the recovery file. Conversely, when TRIM is enabled, the files were damaged and could not be recovered. The files were also not identical to the original so the integrity of evidence was not guaranteed.

show abstract

Live Forensics Analysis of Line App on Proprietary Operating System

Cited by 8 publications

References 9 publications

Analisis Bukti Serangan Address Resolution Protocol Spoofing menggunakan Metode National Institute of Standard Technology

Analisis Bukti Serangan Address Resolution Protocol Spoofing menggunakan Metode National Institute of Standard Technology

Detection of Metasploit Attacks Using RAM Forensic on Proprietary Operating Systems

Live Forensics Method for Acquisition on the Solid State Drive (SSD) NVMe TRIM Function

Contact Info

Product

Resources

About