U.S. flag

An official website of the United States government, Department of Justice.

Visualization in testing a volatile memory forensic tool

NCJ Number
305923
Journal
Digital Investigation Volume: 8 Issue: Supplement Dated: August 2011 Pages: S42-S51
Date Published
August 2011
Length
10 pages
Annotation

This paper reports on the development of a tool to extract the contents of volatile memory of Apple Macs running recent versions of OS X, which has not been possible since OS X 10.4.

Abstract

This paper recounts the authors’ efforts to test the tool and introduces two visualization techniques for that purpose. The authors also introduce four metrics for evaluating physical memory imagers: correctness, completeness, speed, and the amount of “interference” an imager makes to the state of the machine. They evaluate their tool by these metrics and then show visualization using dot plots, a technique borrowed from bioinformatics, which can be used to reveal bugs in the implementation and to evaluate correctness, completeness, and the amount of interference an imager has. They also introduce a visualization they call the density plot, which shows the density of repeated pages at various addresses within an image. They use these techniques to evaluate their own tool, Apple’s earlier tools, and in comparing physical memory images to the hibernation file. (Published abstract provided)

Date Published: August 1, 2011