Live memory forensics of mobile phones |
| |
Institution: | 1. Cryptography & Security Department, Institute for Infocomm Research, 1 Fusionopolis Way, #21-01, Connexis (South Tower), Singapore 138632, Singapore;2. School of Computing, National University of Singapore, Singapore |
| |
Abstract: | In this paper, we proposed an automated system to perform a live memory forensic analysis for mobile phones. We investigated the dynamic behavior of the mobile phone’s volatile memory, and the analysis is useful in real-time evidence acquisition analysis of communication based applications. Different communication scenarios with varying parameters were investigated. Our experimental results showed that outgoing messages (from the phone) have a higher persistency than the incoming messages. In our experiments, we consistently achieved a 100% evidence acquisition rate with the outgoing messages. For the incoming messages, the acquisition rates ranged from 75.6% to 100%, considering a wide range of varying parameters in different scenarios. Hence, in a more realistic scenario where the parties may occasionally take turns to send messages and consecutively send a few messages, our acquisition can capture most of the data to facilitate further detailed forensic investigation. |
| |
Keywords: | |
本文献已被 ScienceDirect 等数据库收录! |
|