皮埃尔·诺拉的“记忆之场”与国族认知——兼论《普鲁斯特之<追忆似水年华>》

20世纪80年代后，学界的“记忆”研究逐渐兴起。法国当代史学名家皮耶?诺哈主编的多卷本《记忆之场》引领了这一潮流，将之聚焦于富有象征意味的“记忆之场”上。诺哈区分了“记忆”与“历史”，指出了“记忆”的“场所”具有的物质性、功能性与象征性，并以庞大的篇幅建构了法国国族自我认知的社会史。其中，孔帕尼翁的《普鲁斯特之<追忆似水年华>》将普鲁斯特及其作品视为一种“记忆之场”，探讨了“泛普鲁斯特学”、成为“法国伟大作家”的普鲁斯特及其成功的社会基础，将“普鲁斯特”这类“建构之象征物”纳入到“法国之所以成为法国”的研究中，表明其保证了一种集体性的、文化与身份认同的再生产；该文也代表了作品研究的另一种进入方式。     

颅脑损伤患者智能和记忆损害的相关因素研究

目的探讨交通事故所致颅脑损伤伤者的智能和记忆损害及相关因素。方法 统计分析成都市1999年1月1日至2001年12月31日间因交通事故造成颅脑损伤的652例伤者的心理测验、脑电图及脑影像学资料。结果研究组平均智商为77.85±15.97,27.9％的伤者智商低于70;51.9％的记忆商低于51。智力损害与文化程度、左颞叶损伤、≥3个脑叶损伤以及脑电图异常明显相关;记忆损害与文化程度、损伤和鉴定检查的间隔时间、脑于损伤、左颞叶损伤、脑电图异常明显相关。结论交通事故造成颅脑损伤的伤者多有不同程度的智力和记忆损害,且与左颞叶损伤、脑电图异常、文化程度、脑干损伤等因素有关。     

An evaluation platform for forensic memory acquisition software

Memory forensics has gradually moved into the focus of researchers and practitioners alike in recent years. With an increasing effort to extract valuable information from a snapshot of a computer's RAM, the necessity to properly assess the respective solutions rises as well. In this paper, we present an evaluation platform for forensic memory acquisition software. The platform is capable of measuring distinct factors that determine the quality of a generated memory image, specifically its correctness, atomicity, and integrity. Tests are performed for three popular open source applications, win32dd, WinPMEM, and mdd, as well as for different memory sizes.     

Advocating for the cause of the “victims of Communism” in the European political space: memory entrepreneurs in interstitial fields

The European Parliament (EP) adopted, between 2004 and 2009, a series of resolutions calling for recognition of Communist crimes and commemoration of their victims. This article focuses on an overlooked aspect of anti-Communist activism, the awareness-raising activities carried out by some Central European Members of the European Parliament (MEPs) to perpetuate the cause through networks that enable them to exchange institutional credibility, scientific legitimacy, and policy-oriented knowledge with Institutes of National Memory, parts of academia, and victims associations. Although they use the techniques of expertise and scandalization that are often effective in European institutions, these memory entrepreneurs have largely failed to further their claims in the European Union (EU) after 2009. In line with the turn toward “practice” in EU studies and the increased attention paid to agency in memory politics, this article contends that the conditions of production of their narrative of indictment of Communism accounts for this relative lack of success. Because their demands produced a strong polarization inside the EP while colliding with established Western patterns of remembrance, these MEPs’ reach remains limited to their Conservative peers from the former Eastern bloc. This weak national and ideological representativeness hinders their capacity to impose their vision of the socialist period in the European political space.     

Integrity verification of user space code

We present a novel approach for the construction and application of cryptographic hashes to user space memory for the purposes of verifying the provenance of code in memory images. Several key aspects of Windows behaviour which influence this process are examined in-depth. Our approach is implemented and evaluated on a selection of malware samples with user space components as well as a collection of common Windows applications. The results demonstrate that our approach is highly effective at reducing the amount of memory requiring manual analysis, highlighting the presence of malicious code in all the malware sampled.     

Robust Linux memory acquisition with minimal target impact

Software based Memory acquisition on modern systems typically requires the insertion of a kernel module into the running kernel. On Linux, kernel modules must be compiled against the exact version of kernel headers and the exact kernel configuration used to build the currently executing kernel. This makes Linux memory acquisition significantly more complex in practice, than on other platforms due to the number of variations of kernel versions and configurations, especially when responding to incidents. The Linux kernel maintains a checksum of kernel version and will generally refuse to load a module which was compiled against a different kernel version. Although there are some techniques to override this check, there is an inherent danger leading to an unstable kernel and possible kernel crashes. This paper presents a novel technique to safely load a pre-compiled kernel module for acquisition on a wide range of Linux kernel versions and configuration. Our technique injects a minimal acquisition module (parasite) into another valid kernel module (host) already found on the target system. The resulting combined module is then relinked in such a way as to grant code execution and control over vital data structures to the acquisition code, whilst the host module remains dormant during runtime.     

Forensic analysis of newer TomTom devices

Today many investigations involve TomTom devices due to the wide-spread use of these navigation systems. The process of acquiring a memory dump from the first generation of TomTom devices was relatively easy by utilising the USB-connection and standard forensic tools. Newer devices, however, do not provide this or any other readily available data connection, making the task much more complex. In addition to existing and relatively complex chip-extraction procedures, an easier data acquisition method was developed without the need to de-solder flash memory chips. The presence of new files and the differences in data formats found in these devices meant that new methods of data analysis and decoding also needed to be developed.     

我国刑事见证制度的价值及完善

刑事见证制度是保证国家公诉的透明度和公信力之关键,具有独立的程序价值。我国刑事诉讼法律规范在见证制度方面存在诸多不足之处,这对司法机关依法规范侦查行为、统一证据标准造成混乱,也对我国的人权保障形成制度障碍。对此,我国刑事诉讼法应当从见证人的选取、见证人的权利和义务、见证制度的违反后果等方面统一见证制度的程序和实体标准,为证据的可信度提供制度保障。