Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers

Research Article

Acquisition of Network Connection Status Information from Physical Memory on Windows Vista Operating System

Download
442 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-23602-0_11,
        author={Lijuan Xu and Lianhai Wang and Lei Zhang and Zhigang Kong},
        title={Acquisition of Network Connection Status Information from Physical Memory on Windows Vista Operating System},
        proceedings={Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers},
        proceedings_a={E-FORENSICS},
        year={2012},
        month={10},
        keywords={computer forensic memory analysis network connection status information},
        doi={10.1007/978-3-642-23602-0_11}
    }
    
  • Lijuan Xu
    Lianhai Wang
    Lei Zhang
    Zhigang Kong
    Year: 2012
    Acquisition of Network Connection Status Information from Physical Memory on Windows Vista Operating System
    E-FORENSICS
    Springer
    DOI: 10.1007/978-3-642-23602-0_11
Lijuan Xu1,*, Lianhai Wang1,*, Lei Zhang1,*, Zhigang Kong1,*
  • 1: Shandong Provincial Key Laboratory of Computer Network
*Contact email: xulj@keylab.net, wanglh@keylab.net, zhanglei@keylab.net, kongzhig@keylab.net

Abstract

A method to extract information of network connection status information from physical memory on Windows Vista operating system is proposed. Using this method, a forensic examiner can extract accurately the information of current TCP/IP network connection information, including IDs of processes which established connections, establishing time, local address, local port, remote address, remote port, etc., from a physical memory on Windows Vista operating system. This method is reliable and efficient. It is verified on Windows Vista, Windows Vista SP1, Windows Vista SP2.