DMCA
Firmware-assisted Memory Acquisition and Analysis Tools for Digital Forensics
| Citations: | 5 - 3 self |
BibTeX
@MISC{Wang_firmware-assistedmemory,
author = {Jiang Wang and Fengwei Zhang and Kun Sun and Angelos Stavrou},
title = {Firmware-assisted Memory Acquisition and Analysis Tools for Digital Forensics},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Being able to inspect and analyze the operational state of commodity machines is crucial for modern digital forensics. Indeed, volatile system state including memory data and CPU registers contain information that cannot be directly inferred or reconstructed by acquiring the contents of the nonvolatile storage. Unfortunately, it still remains an open problem how to reliably and consistently retrieve the volatile machine state without disrupting its operation. In this paper, we propose to leverage commercial PCI network cards and the current x86 implementation of System Management Mode to reliably replicate the physical memory and critical CPU registers from commodity hardware. Furthermore, we demonstrate how remote state replication can be used for semantic reconstruction, where the analysis of memory structures enables us to interactively perform forensic analysis of the machine’s memory content.
Keyphrases
firmware-assisted memory acquisition analysis tool digital forensics current x86 implementation memory data open problem modern digital forensics operational state commodity machine system management mode volatile system state physical memory semantic reconstruction critical cpu register forensic analysis commercial pci network card cpu register remote state replication nonvolatile storage volatile machine state memory structure machine memory content commodity hardware
