|
000
| 02529nam 2200313za 4500 |
|---|
| 001 | 9.821407 |
|---|
| 003 | CaOODSP |
|---|
| 005 | 20240219183451 |
|---|
| 007 | cr ||||||||||| |
|---|
| 008 | 160720s2013 onc|||||o f000 0 eng d |
|---|
| 040 | |aCaOODSP|beng |
|---|
| 041 | |aeng|bfre |
|---|
| 043 | |an-cn--- |
|---|
| 086 | 1 |aD68-6/319-2012E-PDF |
|---|
| 100 | 1 |aCarbone, Richard. |
|---|
| 245 | 14|aThe definitive guide to Linux-based live memory acquisition tools|h[electronic resource] : |ban addendum to "State fo the art concerning memory acquisition software : a detailed examination of Linux, BSD and Solaris live memory acquisition" / |cby Richard Carbone and Sébastien Bourdon-Richard. |
|---|
| 260 | |a[Ottawa] : |bDefence Research and Development Canada, |cc2013. |
|---|
| 300 | |axviii, 100 p. : |btables, figures. |
|---|
| 490 | 1 |aTechnical Memorandum ; |v2012-319 |
|---|
| 500 | |a"September 2013." |
|---|
| 504 | |aIncludes bibliographical references. |
|---|
| 520 | |aThis technical memorandum is an addendum to TM 2012-008, “State of the art concerning memory acquisition: A detailed examination of Linux, BSD and Solaris live memory acquisition.” It examines in detail two additional software tools, Volatility’s Pmem and LiME’s Linux kernel memory drivers, both of which can be used for the memory acquisition of Linuxbased live computer systems. The authors then compare them with Fmem and Second Look, the two best Linux-based memory acquisition tools as per TM 2012-008. Fmem and Second Look are analysed using the same methodology as for Pmem and LiME. This memorandum also amends information pertaining to the faulty memory acquisition of Fmem as conducted in the previous study. Additionally, certain inaccuracies were made in TM 2012-008. This specific text corrects them. As such, it should now be considered the authoritative reference concerning Linux, UNIX and BSD memory acquisition, although the experiments as conducted in TM 2012- 008 will continue to remain valid. Finally, upon completing the analysis of these tools, the authors recommend the use of LiME for investigative fieldwork. However, other tool-specific recommendations are found and examined in the Conclusion. |
|---|
| 692 | 07|2gccst|aTechnical reports |
|---|
| 693 | 4|aComputer forensics |
|---|
| 693 | 4|aCrash driver |
|---|
| 693 | 4|aMemory acquisition |
|---|
| 710 | 2 |aDefence R&D Canada. |
|---|
| 830 | #0|aTechnical memorandum (Defence R&D Canada)|v2012-319|w(CaOODSP)9.820564 |
|---|
| 856 | 40|qPDF|s688 KB|uhttps://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-6-319-2012-eng.pdf |
|---|