Matches in SemOpenAlex for { <https://semopenalex.org/work/W1659883024> ?p ?o ?g. }
Showing items 1 to 69 of
69
with 100 items per page.
- W1659883024 endingPage "100" @default.
- W1659883024 startingPage "89" @default.
- W1659883024 abstract "Physical memory analysis has been an issue on a field of live forensic analysis in digital forensics until now. It is very useful to make the result of analysis more reliable, because record of user behavior and data can be founded on physical memory although process is hided. But most memory analysis focuses on windows based system. Because the diversity of target system to be analyzed rises up, it is very important to analyze physical memory based on other OS, not Windows. Mac OS X, has second market share in Operating System, is operated by loading kernel image to physical memory area. In this paper, We propose a methodology for physical memory analysis on Mac OS X using symbol information in kernel image, and acquire a process information, mounted device information, kernel information, kernel extensions(eg. KEXT) and system call entry for detecting system call hooking. In additional to the methodology, we prove that physical memory analysis is very useful though experimental study." @default.
- W1659883024 created "2016-06-24" @default.
- W1659883024 creator A5058295806 @default.
- W1659883024 creator A5059892393 @default.
- W1659883024 date "2011-01-01" @default.
- W1659883024 modified "2023-10-15" @default.
- W1659883024 title "Research on Mac OS X Physical Memory Analysis" @default.
- W1659883024 hasPublicationYear "2011" @default.
- W1659883024 type Work @default.
- W1659883024 sameAs 1659883024 @default.
- W1659883024 citedByCount "0" @default.
- W1659883024 crossrefType "proceedings-article" @default.
- W1659883024 hasAuthorship W1659883024A5058295806 @default.
- W1659883024 hasAuthorship W1659883024A5059892393 @default.
- W1659883024 hasConcept C111919701 @default.
- W1659883024 hasConcept C114614502 @default.
- W1659883024 hasConcept C133875982 @default.
- W1659883024 hasConcept C171675096 @default.
- W1659883024 hasConcept C176649486 @default.
- W1659883024 hasConcept C33923547 @default.
- W1659883024 hasConcept C41008148 @default.
- W1659883024 hasConcept C74193536 @default.
- W1659883024 hasConcept C74426580 @default.
- W1659883024 hasConcept C76399640 @default.
- W1659883024 hasConcept C98045186 @default.
- W1659883024 hasConcept C98986596 @default.
- W1659883024 hasConceptScore W1659883024C111919701 @default.
- W1659883024 hasConceptScore W1659883024C114614502 @default.
- W1659883024 hasConceptScore W1659883024C133875982 @default.
- W1659883024 hasConceptScore W1659883024C171675096 @default.
- W1659883024 hasConceptScore W1659883024C176649486 @default.
- W1659883024 hasConceptScore W1659883024C33923547 @default.
- W1659883024 hasConceptScore W1659883024C41008148 @default.
- W1659883024 hasConceptScore W1659883024C74193536 @default.
- W1659883024 hasConceptScore W1659883024C74426580 @default.
- W1659883024 hasConceptScore W1659883024C76399640 @default.
- W1659883024 hasConceptScore W1659883024C98045186 @default.
- W1659883024 hasConceptScore W1659883024C98986596 @default.
- W1659883024 hasIssue "4" @default.
- W1659883024 hasLocation W16598830241 @default.
- W1659883024 hasOpenAccess W1659883024 @default.
- W1659883024 hasPrimaryLocation W16598830241 @default.
- W1659883024 hasRelatedWork W1546317334 @default.
- W1659883024 hasRelatedWork W1970914644 @default.
- W1659883024 hasRelatedWork W2016958689 @default.
- W1659883024 hasRelatedWork W2094619820 @default.
- W1659883024 hasRelatedWork W2473750198 @default.
- W1659883024 hasRelatedWork W2518405747 @default.
- W1659883024 hasRelatedWork W2856629117 @default.
- W1659883024 hasRelatedWork W2905611778 @default.
- W1659883024 hasRelatedWork W2933893674 @default.
- W1659883024 hasRelatedWork W3026810404 @default.
- W1659883024 hasRelatedWork W3082160732 @default.
- W1659883024 hasRelatedWork W3104711117 @default.
- W1659883024 hasRelatedWork W3112625270 @default.
- W1659883024 hasRelatedWork W3112945470 @default.
- W1659883024 hasRelatedWork W3114064990 @default.
- W1659883024 hasRelatedWork W3122275765 @default.
- W1659883024 hasRelatedWork W3168718105 @default.
- W1659883024 hasRelatedWork W3196030960 @default.
- W1659883024 hasRelatedWork W3197295005 @default.
- W1659883024 hasRelatedWork W3026304524 @default.
- W1659883024 hasVolume "21" @default.
- W1659883024 isParatext "false" @default.
- W1659883024 isRetracted "false" @default.
- W1659883024 magId "1659883024" @default.
- W1659883024 workType "article" @default.