Forenscope: a framework for live forensics

11 years 7 months ago
Forenscope: a framework for live forensics
Current post-mortem cyber-forensic techniques may cause significant disruption to the evidence gathering process by breaking active network connections and unmounting encrypted disks. Although newer live forensic analysis tools can preserve active state, they may taint evidence by leaving footprints in memory. To help address these concerns we present Forenscope, a framework that allows an investigator to examine the state of an active system without the effects of taint or forensic blurriness caused by analyzing a running system. We show how Forenscope can fit into accepted workflows to improve the evidence gathering process. Forenscope preserves the state of the running system and allows running processes, open files, encrypted filesystems and open network sockets to persist during the analysis process. Forenscope has been tested on live systems to show that it does not operationally disrupt critical processes and that it can perform an analysis in less than 15 seconds while using o...
Ellick Chan, Shivaram Venkataraman, Francis M. Dav
Added 10 Feb 2011
Updated 10 Feb 2011
Type Journal
Year 2010
Authors Ellick Chan, Shivaram Venkataraman, Francis M. David, Amey Chaugule, Roy H. Campbell
Comments (0)