Impact of Tools on the Acquisition of RAM Memory

Marcos Fuentes Martínez
Additional contact information
Marcos Fuentes Martínez: Guardia Civil, Spain

International Journal of Cyber Forensics and Advanced Threat Investigations, 2020, vol. 1, issue 1-3, 3-17

Abstract: When responding to a security incident in a system, several basic principles must be followed regarding the collection of pieces of evidence from the system. The capture of these pieces of evidence has to be done according to its order of volatility. In this sense, RAM memory constitute the most important element to capture, given its extreme volatility. RAM memory must be acquired and analyzed because the data it holds, which may belong to the system itself or to any other device connected to it, can survive a certain amount of time in it. Since RAM is a constantly changing element, it must be stood out that any action carried on the system under analysis will modify the contents of the RAM. In this article a comparative and an objective analysis has been carried out, showing the impact that the execution of some tools for the capture of RAM has on the system. This comparative study details both the private shared workspaces, for each of the processes executed by each of the tools used.

Keywords: DFIR; Digital Forensics; Incident Response; RAM Memory; Windows; Impact of tools (search for similar items in EconPapers)
Date: 2020
References: Add references at CitEc
Citations:

Downloads: (external link)
https://conceptechint.net/index.php/CFATI/article/download/12/2 (application/pdf)
https://conceptechint.net/index.php/CFATI/article/view/12 (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aox:rcfati:v:1:y:2020:i:1-3:p:3-17

DOI: 10.46386/ijcfati.v1i1-3.12

Access Statistics for this article

International Journal of Cyber Forensics and Advanced Threat Investigations is currently edited by Professor John William Walker

More articles in International Journal of Cyber Forensics and Advanced Threat Investigations from Concept Tech Publishing
Bibliographic data for series maintained by Mira Leonko ().