A Study of System Log and Volatile Information Collection for Computer Forensics

컴퓨터 포렌식스 지원을 위한 시스템 로그 및 휘발성 정보 수집에 관한 연구

In Digital Computing Environment, volatile information such as register, cache memory, and network information are hard to make certain of a real-time collection because such volatile information are easily modified or disappeared. Thus, a collection of volatile information is one of important step for computer forensics system on ubiquitous computing. In this paper, we propose a volatile information collection module, which collects variable volatile information of server system based on memory mapping in real-time.