Digital Forensics and Cyber Crime. Second International ICST Conference, ICDF2C 2010, Abu Dhabi, United Arab Emirates, October 4-6, 2010, Revised Selected Papers

Research Article

Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire

Download
685 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-19513-6_5,
        author={Pavel Gladyshev and Afrah Almansoori},
        title={Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire},
        proceedings={Digital Forensics and Cyber Crime. Second International ICST Conference, ICDF2C 2010, Abu Dhabi, United Arab Emirates, October 4-6, 2010, Revised Selected Papers},
        proceedings_a={ICDF2C},
        year={2012},
        month={5},
        keywords={RAM Analysis Mac OS X FireWire AOL Instant Messenger (AIM)},
        doi={10.1007/978-3-642-19513-6_5}
    }
    
  • Pavel Gladyshev
    Afrah Almansoori
    Year: 2012
    Reliable Acquisition of RAM Dumps from Intel-Based Apple Mac Computers over FireWire
    ICDF2C
    Springer
    DOI: 10.1007/978-3-642-19513-6_5
Pavel Gladyshev1,*, Afrah Almansoori2,*
  • 1: University College Dublin
  • 2: Dubai Police Head Quarters
*Contact email: Pavel.Gladyshev@ucd.ie, Almansoori@CyberCrimeTech.com

Abstract

RAM content acquisition is an important step in live forensic analysis of computer systems. FireWire offers an attractive way to acquire RAM content of Apple Mac computers equipped with a FireWire connection. However, the existing techniques for doing so require substantial knowledge of the target computer configuration and cannot be used reliably on a previously unknown computer in a crime scene. This paper proposes a novel method for acquiring RAM content of Apple Mac computers over FireWire, which automatically discovers necessary information about the target computer and can be used in the crime scene setting. As an application of the developed method, the techniques for recovery of AOL Instant Messenger (AIM) conversation fragments from RAM dumps are also discussed in this paper.