A Model of Computer Live Forensics Based on Physical Memory Analysis

Abstract

This paper provides a look at some of the shortcomings of current approaches to live forensics. On this basis, a model of computer live forensics based on physical memory analysis is proposed. The model can be used to effectively address many of the challenges facing the conventional live forensics. Then taking the credibility of digital evidence as a starting point, the issue of credibility of live forensic is then put forward for study. Finally, methods of credibility calculation are given through probabilistic and statistical computing. This work may help to improve the scientific credibility of the digital evidence acquired by live forensic in current practice.