Process Memory Investigation of the Bitcoin Clients Electrum and Bitcoin Core
Process Memory Investigation of the Bitcoin Clients Electrum and Bitcoin Core
复制标题
比特币客户端 Electrum 和 Bitcoin Core 的进程内存调查
作者：
Luuc Van Der Horst;Kim;Nhien
据报道，比特币是一种广泛用于犯罪活动的数字货币（例如用于在线购买非法毒品和在勒索软件案件中支付赎金）。然而，文献中对比特币客户端的取证研究有限。在本文中，研究了两个流行的比特币客户端，bitcoin Core和electrum的进程内存，目的是识别潜在的相关数据（例如比特币密钥，交易数据和密码短语）的潜在来源和类型。从进程内存中获得的工件还与从客户端设备获得的其他工件（磁盘上的应用程序文件和内存映射文件和注册表项）一起进行研究。本研究的结果表明，比特币核心和electrum的进程内存都是有价值的证据来源，并且在进程内存中发现的许多工件也可以从客户端设备（磁盘）上的应用程序和钱包文件中获得。
Bitcoin cryptocurrency is reportedly one widely used digital currency in criminal activities (e.g. used for online purchases of illicit drugs and paying of ransom in ransomware cases). However, there has been limited forensic research of bitcoin clients in the literature. In this paper, the process memory of two popular bitcoin clients, bitcoin Core and electrum, is examined with the aims of identifying potential sources and types of potential relevant data (e.g. bitcoin keys, transaction data and passphrases). Artefacts obtained from the process memory are also studied with other artefacts obtained from the client device (application files on disk and memory-mapped files and registry keys). Findings from this study suggest that both bitcoin Core and electrum’s process memory is a valuable source of evidence, and many of the artefacts found in process memory are also available from the application and wallet files on the client device (disk).