Exploring Static and Live Digital Forensics: Methods, Practices and Tools
Exploring Static and Live Digital Forensics: Methods, Practices and Tools
复制标题
探索静态和实时数字取证：方法、实践和工具
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
M. Khan
中科院分区：
文献类型：
--
作者：
M. Rafique;M. Khan
数据分析和检查在数字取证中进行。如今，计算机是主要的通信来源，调查人员也可以使用计算机来获取与法医有关的信息。法医分析可以在静态和实时模式下进行。传统的方法提供的证据数据不完整，而实时分析工具可以为调查人员提供当前和预处理运行过程的更准确和一致的画面。存在于易失性存储器中的许多重要的系统相关信息不能通过使用静态分析技术来有效地恢复。在本文中，我们提出了一个静态和现场分析方法的关键审查，我们评估的可靠性，不同的工具和技术，用于静态和现场数字取证分析。
Analysis and examination of data is performed in digital forensics. Nowadays computer is the major source of communication which can also be used by the investigators to gain forensically relevant information. Forensic analysis can be done in static and live modes. Traditional approach pro- vides incomplete evidentiary data, while live analysis tools can provide the investigators a more accurate and consistent picture of the current and pre- viously running processes. Many important system related information present in volatile memory cannot be effectively recovered by using static analysis techniques. In this paper, we present a critical review of static and live analysis approaches and we evaluate the reliability of different tools and tech- niques used in static and live digital forensic analysis.