Correctness, Atomicity, and Integrity: Defining Criteria for Forensically-Sound Memory Acquisition

Beitrag in einer Fachzeitschrift
(Originalarbeit)


Details zur Publikation

Autorinnen und Autoren: Vömel S, Freiling F
Zeitschrift: Digital Investigation
Verlag: Elsevier
Jahr der Veröffentlichung: 2012
Band: 9
Heftnummer: 2
Seitenbereich: 125-137
ISSN: 1742-2876
eISSN: 1873-202X


Abstract

While procedures for forensic memory analysis have been well described in the literature, the actual data acquisition process has been researched to a lesser degree. In particular, even though forensic analysts commonly agree that a memory snapshot should be "correct", "sound", and "reliable", the meaning of these terms still remains informal and vague. In this paper, we formalize three fundamental criteria, correctness, atomicity, and integrity, that determine the quality of a forensic memory image. We illustrate the criteria with the help of a number of intuitive examples, discuss the meaning of forensic soundness as well as outline implications and challenges for memory acquisition solutions available on the market to date. © 2012 Elsevier Ltd. All rights reserved.


FAU-Autorinnen und Autoren / FAU-Herausgeberinnen und Herausgeber

Freiling, Felix Prof. Dr.-Ing.
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
Vömel, Stefan
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)


Zitierweisen

APA:
Vömel, S., & Freiling, F. (2012). Correctness, Atomicity, and Integrity: Defining Criteria for Forensically-Sound Memory Acquisition. Digital Investigation, 9(2), 125-137. https://dx.doi.org/10.1016/j.diin.2012.04.005

MLA:
Vömel, Stefan, and Felix Freiling. "Correctness, Atomicity, and Integrity: Defining Criteria for Forensically-Sound Memory Acquisition." Digital Investigation 9.2 (2012): 125-137.

BibTeX: 

Zuletzt aktualisiert 2019-28-07 um 07:14