Inefficiency of Data Storing in Physical Memory

Authors: Kamaruddin Malik Mohamad, Sapiee Haji Jamel, Mustafa Mat Deris

Abstract:

Memory forensic is important in digital investigation. The forensic is based on the data stored in physical memory that involve memory management and processing time. However, the current forensic tools do not consider the efficiency in terms of storage management and the processing time. This paper shows the high redundancy of data found in the physical memory that cause inefficiency in processing time and memory management. The experiment is done using Borland C compiler on Windows XP with 512 MB of physical memory.

Keywords: Digital Evidence, Memory Forensics.

Digital Object Identifier (DOI): doi.org/10.5281/zenodo.1055769

References:

[1] DFRWS Technical Report, (2001), A Road Map for Digital Forensic Research, Digital Forensic Research Workshop (DFRWS).
[2] Burdach, M. (2005), Digital Forensics of the Physical Memory, Warsaw University.
[3] http://www.e-fense.com/helix/; accessed on 09 Sep, 2008.
[4] http://www.foundstone.com/us/resources/proddesc/bintext.htm; accessed on 09 Sep, 2008.