Volatile Memory Message Carving: A "per process basis" Approach

<p>The pace at which data and information transfer and storage has shifted from PCs to mobile devices is of great concern to the digital forensics community. Android is fast becoming the operating system of choice for these hand-held devices, hence the need to develop better forensic techniques for data recovery cannot be over-emphasized. This thesis analyzes the volatile memory for Motorola Android devices with a shift from traditional physical memory extraction to carving residues of data on a “per process basis”. Each Android application runs in a separate process within its own Dalvik Virtual Machine (JVM) instance, thus, the proposed “per process basis” approach. To extract messages, we first extract the runtime memory of the MotoBlur application, then carve and reconstruct both deleted and undeleted messages (emails and chat messages). An experimental study covering two Android phones is also presented.</p>

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Year dc:date.available

2012

Author dc:creator

• Ali-Gombe, Aisha Ibrahim

Contributors dc:contributor

• Dr. Golden Richard III
• Dr. Vassil Roussev
• Dr. Adlai Depano

• per process, Android
• memory management
• process priority
• carving
• volatile memory
• Other Computer Sciences

Repository record dc:identifier

https://scholarworks.uno.edu/td/1569

OAI identifier oai:identifier

oai:scholarworks.uno.edu:td-2614