Inefficiency of Data Storing in Physical Memory

Memory forensic is important in digital investigation. The forensic is based on the data stored in physical memory that involve memory management and processing time. However, the current forensic tools do not consider the efficiency in terms of storage management and the processing time. This paper shows the high redundancy of data found in the physical memory that cause inefficiency in processing time and memory management. The experiment is done using Borland C compiler on Windows XP with 512 MB of physical memory.

Authors:

• Kamaruddin Malik Mohamad
• Sapiee Haji Jamel
• Mustafa Mat Deris

Keywords:

• Digital Evidence
• Memory Forensics.

References:

[1] DFRWS Technical Report, (2001), A Road Map for Digital Forensic
Research, Digital Forensic Research Workshop (DFRWS).
[2] Burdach, M. (2005), Digital Forensics of the Physical Memory, Warsaw
University.
[3] http://www.e-fense.com/helix/; accessed on 09 Sep, 2008.
[4] http://www.foundstone.com/us/resources/proddesc/bintext.htm; accessed
on 09 Sep, 2008.