Significance of Residual Artifacts from Random Access Memory

Sreelakshmi K, Princy Sugathan

Abstract: Insistent data-oriented approaches in computer forensics face some limitations regarding a number of technological developments, that make an in-time investigation more and more difficult. In order to cope with these issues, security professionals have started to inspect alternative data sources and emphasize the value of volatile system information in RAM more recently. By imaging this part of computer memory and by performing forensics analysis of the data located in RAM, it can be easily concluded that accomplishing RAM imagining and analysis should be one of the essential steps in any forensic investigation. This paper will give a brief introduction to digital forensics and the role of live data forensics. Furthermore, the main goal will be to show and explain the importance of forensics of live machines and artifacts which can be found and are used for extracting and analysing data from RAM.

Keywords: Digital forensics, RAM, Live Data Forensics, Volatile Data, Memory Acquisition