Skip to main content
Article
In-Depth Analysis of Computer Memory Acquisition Software for Forensic Purposes
Journal of Forensic Sciences
  • Robert J. McDown, Sam Houston State University
  • Cihan Varol, Sam Houston State University
  • Leonardo Carvajal, Sam Houston State University
  • Lei Chen, Georgia Southern University
Document Type
Article
Publication Date
11-17-2015
DOI
10.1111/1556-4029.12979
Disciplines
Abstract

The comparison studies on random access memory (RAM) acquisition tools are either limited in metrics or the selected tools were designed to be executed in older operating systems. Therefore, this study evaluates widely used seven shareware or freeware/open source RAM acquisition forensic tools that are compatible to work with the latest 64-bit Windows operating systems. These tools' user interface capabilities, platform limitations, reporting capabilities, total execution time, shared and proprietary DLLs, modified registry keys, and invoked files during processing were compared. We observed that Windows Memory Reader and Belkasoft's Live Ram Capturer leaves the least fingerprints in memory when loaded. On the other hand, ProDiscover and FTK Imager perform poor in memory usage, processing time, DLL usage, and not-wanted artifacts introduced to the system. While Belkasoft's Live Ram Capturer is the fastest to obtain an image of the memory, Pro Discover takes the longest time to do the same job.

Citation Information
Robert J. McDown, Cihan Varol, Leonardo Carvajal and Lei Chen. "In-Depth Analysis of Computer Memory Acquisition Software for Forensic Purposes" Journal of Forensic Sciences Vol. 61 Iss. S1 (2015) p. S110 - S116 ISSN: 1556-4029
Available at: http://works.bepress.com/lei-chen/3/