Volatile Memory Forensics: A Legal Perspective

Mann, Harnoor Kaur; Chhabra, Gurpal Singh

doi:10.5120/ijca2016912276

Cited by 4 publications

(4 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…RAM merupakan tempat penyimpanan sementara ketika komputer dijalankan. Penggunaan aplikasi pada komputer meninggalkan data dan informasi pada Random Access Memory (RAM) [4]. Data dan informasi yang terdapat pada RAM dapat hilang jika sistem mati, maka diperlukan penanganan data dan informasi pada RAM harus dilakukan dengan hati-hati [5].…”

Section: Pendahuluanunclassified

Analisis Bukti Digital pada Telegram Messenger Menggunakan Framework NIST

Ramadhona,

Azizah,

Gustitio

2024

View full text Add to dashboard Cite

Kejahatan dunia maya semakin meningkat seiring dengan berkembangnya teknologi yang meningkat. Kasus kejahatan penipuan online shop menjadi salah satu tindak kejahatan yang sering terjadi. Kejahatan ini memanfaatkan salah satu aplikasi Instant Messenger yang cukup populer yaitu Telegram. Telegram berbasis desktop merupakan salah satu aplikasi yang dapat dijalankan pada komputer, khususnya komputer sistem operasi Windows 10. Semua aplikasi yang dijalankan pada komputer meninggalkan data dan informasi pada Random Access Memory (RAM). Data dan informasi tersebut dapat diperoleh dari RAM menggunakan teknik live forensics yang dapat digunakan ketika komputer sedang berjalan dan terkoneksi internet. Penelitian ini bertujuan untuk menemukan bukti digital pada kasus penipuan online shop. Bukti digital tersebut diperoleh dengan menggunakan tools FTK Imager dengan mengakuisisi RAM pada komputer untuk mendapatkan data dan informasi pada RAM. Hasil penelitian ini diperoleh bukti percakapan antara tersangka dan korban menggunakan Telegram untuk mengungkap tindak kejahatan penipuan online shop.

show abstract

Section: Pendahuluanunclassified

Analisis Bukti Digital pada Telegram Messenger Menggunakan Framework NIST

Ramadhona,

Azizah,

Gustitio

2024

View full text Add to dashboard Cite

show abstract

“…RAM is volatile, where data will be lost if the computer is dead [11] [12]. For this reason, a live forensic technique is needed to save potential digital evidence on RAM when it is on [13][14] [15].…”

Section: Introductionmentioning

confidence: 99%

Detection of Metasploit Attacks Using RAM Forensic on Proprietary Operating Systems

Prakoso

Riadi

Prayudi

2020

KINETIK

View full text Add to dashboard Cite

Information technology has become an essential thing in the digital era as it is today. With the support of computer networks, information technology is used as a medium for exchanging data and information. Much information is confidential. Therefore, security is also essential. Metasploit is one of the frameworks commonly used by penetration testers to audit or test the security of a computer system legally, but it does not rule out the possibility that Metasploit can also be used for crime. For this reason, it is necessary to carry out a digital forensic process to uncover these crimes. In this study, a simulation of attacks on Windows 10 will be carried out with Metasploit. Then the digital forensics process uses live forensics techniques on computer RAM, where the computer RAM contains information about the processes running on the computer. The live forensic technique is important because information on RAM will be lost if the computer is off. This research will use FTK Imager, Dumpit, and Magnet RAM Capture as the RAM acquisition tool and Volatility as the analysis tool. The results of the research have successfully shown that the live forensics technique in RAM is able to obtain digital evidence in the form of an attacker's IP, evidence of exploits/Trojans, processes running on RAM, operating system profiles used and the location of the exploits/Trojan when executed by the victim.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Applications that run on the computer leave data and information on Random Access Memory (RAM) [7]. RAM is a temporary storage place when the computer system is running and can be accessed quickly [7] [8]. Therefore handling data and information on RAM must be done quickly and carefully because the data and information will be lost if the system dies [9].…”

Section: Introductionmentioning

confidence: 99%

Live Forensics Analysis of Line App on Proprietary Operating System

Riadi

Sunardi

Rauli

2019

KINETIK

View full text Add to dashboard Cite

The development of computer technology is increasing rapidly. This has positive and negative effects. One of the negative effects that occurred was the use of Line applications to conduct online shop fraud. Line is one of the instant messenger applications that can be used on computers, especially on Windows 8.1 operating system computers. Applications that run on the computer leave traces of data on Random Access Memory (RAM). Data left in RAM can be obtained using digital forensic techniques, namely live forensics which is used when the computer is running and connected to the internet. This study aims to find digital evidence regarding cases of online shop fraud using the National Institute of Standards and Technology (NIST) method. Digital evidence can be obtained using forensic tools, namely RamCapturer, FTK Imager and Winhex. RamCapturer is used to acquire data in RAM, FTK Imager is used for imaging and Winhex is used to analyze data that has been taken. The results obtained in this study were conversational recordings consisting of conversation time, conversation content and conversation status which could be digital evidence in uncovering the online shop fraud crime that occurred.

show abstract

Volatile Memory Forensics: A Legal Perspective

Cited by 4 publications

References 8 publications

Analisis Bukti Digital pada Telegram Messenger Menggunakan Framework NIST

Analisis Bukti Digital pada Telegram Messenger Menggunakan Framework NIST

Detection of Metasploit Attacks Using RAM Forensic on Proprietary Operating Systems

Live Forensics Analysis of Line App on Proprietary Operating System

Contact Info

Product

Resources

About