Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire

Investigating America Online Instant Messaging Application

“…A study of such may not be useful for evidence acquisition without prior knowledge of the incriminating conversations. Gladyshev and Almansoori (2010) proposed a method for acquiring known AIM conversation fragments from the memory dumps of Apple Mac computers. The researchers identified that the conversation fragments could be generally classified into 4 different formats, all of which held corresponding screen names, conversation texts, and timestamp information.…”