Research on Electronic Data Forensics Based on RAM

Abstract

Electronic data forensics is the process of obtaining, preserving, analyzing and presenting evidence for computer invasion, destruction, fraud, attack and other criminal acts. Some key digital evidence of cybercrime exists in physical memory or stored in page exchange files, so memory forensics is an important part of electronic data forensics. This paper studies RAM-based electronic data forensics with the use of the memory forensics tool Volatility. By obtaining the memory data of real equipment, cloud computing, virtual machine or virtual devices, performing the extraction and analysis of process information, registry, network connection, strings, access records and other contents, and extracting the digital evidence related to network attack or network crime.