Study on constructing malware attack forensic procedure of digital evidence

Abstract

This study intended to improve two common problems of digital evidences: preservation and ease to modified; during preservation, collection, validation, identification, analysis, interpretation, documentation and presentation processes. We used I-Forensics (LiveDetector & LiveSearch) tools kit to explore digital evidence of malware attack in Windows system to produces a standard operation procedure. The main purpose is to provide forensic operators a reliable and accountable standard and guideline mechanism.