On-the-spot digital investigation by means of LDFS: Live Data Forensic System

Kyung Soo Lim, Antonio Savoldi, Changhoon Lee, Sangjin Lee

Research output: Contribution to journalArticle

8 Citations (Scopus)

Abstract

The ever growing capacity of hard drives poses a severe problem to forensic practitioners who strive to deal with digital investigations in a timely manner. Therefore, the on-the-spot digital investigation paradigm is emerging as a new standard to select only that evidence which is important for the case being investigated. In the light of this issue, we propose an incident response tool which is able to speed up the investigation by finding crime-related evidence in a faster way compared with the traditional state-of-the-art post-mortem analysis tools. The tool we have implemented is called Live Data Forensic System (LDFS). LDFS is an on-the-spot live forensic toolkit, which can be used to collect and analyze relevant data in a timely manner and to perform a triage of a Microsoft Windows-based system. Particularly, LDFS demonstrates the ability of the tool to automatically gather evidence according to general categories, such as live data, Windows Registry, file system metadata, instant messaging services clients, web browser artifacts, memory dump and page file. In addition, unified analysis tools of ELF provide a fast and effective way to obtain a picture of the system at the time the analysis is done. The result of the analysis from different categories can be easily correlated to provide useful clues for the sake of the investigation.

Original languageEnglish
Pages (from-to)223-240
Number of pages18
JournalMathematical and Computer Modelling
Volume55
Issue number1-2
DOIs
Publication statusPublished - 2012 Jan 1

Fingerprint

Web browsers
Crime
File System
Metadata
Instant
Speedup
Paradigm
Data storage equipment
Demonstrate
Evidence
Standards

Keywords

  • Automated digital investigation process
  • Live forensics
  • On-the-spot digital investigation

ASJC Scopus subject areas

  • Computer Science Applications
  • Modelling and Simulation

Cite this

On-the-spot digital investigation by means of LDFS : Live Data Forensic System. / Lim, Kyung Soo; Savoldi, Antonio; Lee, Changhoon; Lee, Sangjin.

In: Mathematical and Computer Modelling, Vol. 55, No. 1-2, 01.01.2012, p. 223-240.

Research output: Contribution to journalArticle

Lim, Kyung Soo ; Savoldi, Antonio ; Lee, Changhoon ; Lee, Sangjin. / On-the-spot digital investigation by means of LDFS : Live Data Forensic System. In: Mathematical and Computer Modelling. 2012 ; Vol. 55, No. 1-2. pp. 223-240.
@article{53bde44e10884342a097eee2f25fa208,
title = "On-the-spot digital investigation by means of LDFS: Live Data Forensic System",
abstract = "The ever growing capacity of hard drives poses a severe problem to forensic practitioners who strive to deal with digital investigations in a timely manner. Therefore, the on-the-spot digital investigation paradigm is emerging as a new standard to select only that evidence which is important for the case being investigated. In the light of this issue, we propose an incident response tool which is able to speed up the investigation by finding crime-related evidence in a faster way compared with the traditional state-of-the-art post-mortem analysis tools. The tool we have implemented is called Live Data Forensic System (LDFS). LDFS is an on-the-spot live forensic toolkit, which can be used to collect and analyze relevant data in a timely manner and to perform a triage of a Microsoft Windows-based system. Particularly, LDFS demonstrates the ability of the tool to automatically gather evidence according to general categories, such as live data, Windows Registry, file system metadata, instant messaging services clients, web browser artifacts, memory dump and page file. In addition, unified analysis tools of ELF provide a fast and effective way to obtain a picture of the system at the time the analysis is done. The result of the analysis from different categories can be easily correlated to provide useful clues for the sake of the investigation.",
keywords = "Automated digital investigation process, Live forensics, On-the-spot digital investigation",
author = "Lim, {Kyung Soo} and Antonio Savoldi and Changhoon Lee and Sangjin Lee",
year = "2012",
month = "1",
day = "1",
doi = "10.1016/j.mcm.2011.05.019",
language = "English",
volume = "55",
pages = "223--240",
journal = "Mathematical and Computer Modelling",
issn = "0895-7177",
publisher = "Elsevier Limited",
number = "1-2",

}

TY - JOUR

T1 - On-the-spot digital investigation by means of LDFS

T2 - Live Data Forensic System

AU - Lim, Kyung Soo

AU - Savoldi, Antonio

AU - Lee, Changhoon

AU - Lee, Sangjin

PY - 2012/1/1

Y1 - 2012/1/1

N2 - The ever growing capacity of hard drives poses a severe problem to forensic practitioners who strive to deal with digital investigations in a timely manner. Therefore, the on-the-spot digital investigation paradigm is emerging as a new standard to select only that evidence which is important for the case being investigated. In the light of this issue, we propose an incident response tool which is able to speed up the investigation by finding crime-related evidence in a faster way compared with the traditional state-of-the-art post-mortem analysis tools. The tool we have implemented is called Live Data Forensic System (LDFS). LDFS is an on-the-spot live forensic toolkit, which can be used to collect and analyze relevant data in a timely manner and to perform a triage of a Microsoft Windows-based system. Particularly, LDFS demonstrates the ability of the tool to automatically gather evidence according to general categories, such as live data, Windows Registry, file system metadata, instant messaging services clients, web browser artifacts, memory dump and page file. In addition, unified analysis tools of ELF provide a fast and effective way to obtain a picture of the system at the time the analysis is done. The result of the analysis from different categories can be easily correlated to provide useful clues for the sake of the investigation.

AB - The ever growing capacity of hard drives poses a severe problem to forensic practitioners who strive to deal with digital investigations in a timely manner. Therefore, the on-the-spot digital investigation paradigm is emerging as a new standard to select only that evidence which is important for the case being investigated. In the light of this issue, we propose an incident response tool which is able to speed up the investigation by finding crime-related evidence in a faster way compared with the traditional state-of-the-art post-mortem analysis tools. The tool we have implemented is called Live Data Forensic System (LDFS). LDFS is an on-the-spot live forensic toolkit, which can be used to collect and analyze relevant data in a timely manner and to perform a triage of a Microsoft Windows-based system. Particularly, LDFS demonstrates the ability of the tool to automatically gather evidence according to general categories, such as live data, Windows Registry, file system metadata, instant messaging services clients, web browser artifacts, memory dump and page file. In addition, unified analysis tools of ELF provide a fast and effective way to obtain a picture of the system at the time the analysis is done. The result of the analysis from different categories can be easily correlated to provide useful clues for the sake of the investigation.

KW - Automated digital investigation process

KW - Live forensics

KW - On-the-spot digital investigation

UR - http://www.scopus.com/inward/record.url?scp=82755182926&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=82755182926&partnerID=8YFLogxK

U2 - 10.1016/j.mcm.2011.05.019

DO - 10.1016/j.mcm.2011.05.019

M3 - Article

AN - SCOPUS:82755182926

VL - 55

SP - 223

EP - 240

JO - Mathematical and Computer Modelling

JF - Mathematical and Computer Modelling

SN - 0895-7177

IS - 1-2

ER -