Matches in SemOpenAlex for { <https://semopenalex.org/work/W64970136> ?p ?o ?g. }
Showing items 1 to 66 of
66
with 100 items per page.
- W64970136 endingPage "175" @default.
- W64970136 startingPage "171" @default.
- W64970136 abstract "This paper details an investigation aimed at identifying the application level evidence that can be extracted from volatile memory. Application level evidence indicates how the user is using an application when a memory image is collected. Commonly used Windows applications have been tested; Microsoft Word 2007, Microsoft Excel 2007, Adobe Reader 9.0, Microsoft PowerPoint 2007 and Internet Explorer 7.0. Details of what the user was doing at the time of the memory capture were found and analysed. Fragments of user information (for example, documents they were working on and the web pages they viewed) were found in various areas of memory for all applications. Both Microsoft Word and Internet Explorer stored all of the user data on contiguous memory blocks which made the evidence easy to find. However, very little evidence was found when the user was using Adobe Reader 9.0 and only fragmented evidence was found in Excel 2007 and PowerPoint 2007. The methodology and the results of this research will aid investigators in gathering and analysing forensic information from a computer system." @default.
- W64970136 created "2016-06-24" @default.
- W64970136 creator A5005403597 @default.
- W64970136 creator A5040449764 @default.
- W64970136 creator A5055929723 @default.
- W64970136 date "2009-01-01" @default.
- W64970136 modified "2023-09-27" @default.
- W64970136 title "Application level evidence from volatile memory" @default.
- W64970136 hasPublicationYear "2009" @default.
- W64970136 type Work @default.
- W64970136 sameAs 64970136 @default.
- W64970136 citedByCount "11" @default.
- W64970136 countsByYear W649701362012 @default.
- W64970136 countsByYear W649701362013 @default.
- W64970136 countsByYear W649701362016 @default.
- W64970136 countsByYear W649701362020 @default.
- W64970136 crossrefType "journal-article" @default.
- W64970136 hasAuthorship W64970136A5005403597 @default.
- W64970136 hasAuthorship W64970136A5040449764 @default.
- W64970136 hasAuthorship W64970136A5055929723 @default.
- W64970136 hasConcept C110875604 @default.
- W64970136 hasConcept C111919701 @default.
- W64970136 hasConcept C136764020 @default.
- W64970136 hasConcept C204321447 @default.
- W64970136 hasConcept C2777904410 @default.
- W64970136 hasConcept C2983335612 @default.
- W64970136 hasConcept C41008148 @default.
- W64970136 hasConcept C523788702 @default.
- W64970136 hasConceptScore W64970136C110875604 @default.
- W64970136 hasConceptScore W64970136C111919701 @default.
- W64970136 hasConceptScore W64970136C136764020 @default.
- W64970136 hasConceptScore W64970136C204321447 @default.
- W64970136 hasConceptScore W64970136C2777904410 @default.
- W64970136 hasConceptScore W64970136C2983335612 @default.
- W64970136 hasConceptScore W64970136C41008148 @default.
- W64970136 hasConceptScore W64970136C523788702 @default.
- W64970136 hasLocation W649701361 @default.
- W64970136 hasOpenAccess W64970136 @default.
- W64970136 hasPrimaryLocation W649701361 @default.
- W64970136 hasRelatedWork W1480756613 @default.
- W64970136 hasRelatedWork W1497599343 @default.
- W64970136 hasRelatedWork W1852675693 @default.
- W64970136 hasRelatedWork W2010376606 @default.
- W64970136 hasRelatedWork W2016650184 @default.
- W64970136 hasRelatedWork W2036896909 @default.
- W64970136 hasRelatedWork W2042750133 @default.
- W64970136 hasRelatedWork W2049313997 @default.
- W64970136 hasRelatedWork W2116654667 @default.
- W64970136 hasRelatedWork W2132174782 @default.
- W64970136 hasRelatedWork W2260620523 @default.
- W64970136 hasRelatedWork W2478929913 @default.
- W64970136 hasRelatedWork W249628192 @default.
- W64970136 hasRelatedWork W2563683849 @default.
- W64970136 hasRelatedWork W2734411515 @default.
- W64970136 hasRelatedWork W2965318486 @default.
- W64970136 hasRelatedWork W3197028414 @default.
- W64970136 hasRelatedWork W48785779 @default.
- W64970136 hasRelatedWork W846930283 @default.
- W64970136 hasRelatedWork W2165615620 @default.
- W64970136 hasVolume "10" @default.
- W64970136 isParatext "false" @default.
- W64970136 isRetracted "false" @default.
- W64970136 magId "64970136" @default.
- W64970136 workType "article" @default.