Vömel S, Freiling F (2012)
Publication Type: Journal article, Original article
Publication year: 2012
Publisher: Elsevier
Book Volume: 9
Pages Range: 125-137
Journal Issue: 2
DOI: 10.1016/j.diin.2012.04.005
While procedures for forensic memory analysis have been well described in the literature, the actual data acquisition process has been researched to a lesser degree. In particular, even though forensic analysts commonly agree that a memory snapshot should be "correct", "sound", and "reliable", the meaning of these terms still remains informal and vague. In this paper, we formalize three fundamental criteria, correctness, atomicity, and integrity, that determine the quality of a forensic memory image. We illustrate the criteria with the help of a number of intuitive examples, discuss the meaning of forensic soundness as well as outline implications and challenges for memory acquisition solutions available on the market to date. © 2012 Elsevier Ltd. All rights reserved.
APA:
Vömel, S., & Freiling, F. (2012). Correctness, Atomicity, and Integrity: Defining Criteria for Forensically-Sound Memory Acquisition. Digital Investigation, 9(2), 125-137. https://doi.org/10.1016/j.diin.2012.04.005
MLA:
Vömel, Stefan, and Felix Freiling. "Correctness, Atomicity, and Integrity: Defining Criteria for Forensically-Sound Memory Acquisition." Digital Investigation 9.2 (2012): 125-137.
BibTeX: Download