The Experts below are selected from a list of 1032 Experts worldwide ranked by ideXlab platform

B.b. Meshram - One of the best experts on this subject based on the ideXlab platform.

  • RegAnalyzer Tool to Automate Windows 7 Registry Forensics Analysis
    International Journal of Advanced Research in Computer Science, 2011
    Co-Authors: Sameer H. Mahant, B.b. Meshram
    Abstract:

    Use of computers for performing crimes is increasing day by day. It has become necessary for Investigator to collect evidences from suspect’s computer. Windows 7 has become mainstream operating system for users and thus its Forensics investigation is becoming important. One of the areas of interest is windows registry. It contains valuable information that can be helpful for the Forensics analysis. Registry contains the basic information like date when Operating System installed, owner name and the advanced information such as the software and hardware devices installed on system, storage devices attached to system, services running on system, history of recently used documents and so on, which will help the analyst to decide the way of further analysis of system depending on the its environment. Though it has such valuable information it is very difficult for an analyst to manually search and analyze it to collect evidences because of its complex structure. So in this paper we presented details of Windows 7 registry, its use for forensic analysis and proposed design for a tool (RegAnalyzer) which will automate task of windows 7 registry analysis for Forensics Investigator so he/she can use it for the further investigation of system. Keywords: computer Forensics; registry Forensics; registry structure; windows 7 Forensics; windows registry

Thomas Martin - One of the best experts on this subject based on the ideXlab platform.

  • Forensic Analysis of the Windows 7 Registry
    Journal of Digital Forensics Security and Law, 2010
    Co-Authors: Khawla Alghafli, Andy Jones, Thomas Martin
    Abstract:

    The recovery of digital evidence of crimes from storage media is an increasingly time consuming process as the capacity of the storage media is in a state of constant growth. It is also a difficult and complex task for the forensic Investigator to analyse all of the locations in the storage media. These two factors, when combined, may result in a delay in bringing a case to court. The concept of this paper is to start the initial forensic analysis of the storage media in locations that are most likely to contain digital evidence, the Windows Registry. Consequently, the forensic analysis process and the recovery of digital evidence may take less time than would otherwise be required. In this paper, the Registry structure of Windows 7 is discussed together with several elements of information within the Registry of Windows 7 that may be valuable to a forensic Investigator. These elements were categorized into five groups which are system, application, networks, attached devices and the history lists. We have discussed the values of identified elements to a forensic Investigator. Also, a tool was implemented to perform the function of extracting these elements and presents them in usable form to a Forensics Investigator.

Sameer H. Mahant - One of the best experts on this subject based on the ideXlab platform.

  • RegAnalyzer Tool to Automate Windows 7 Registry Forensics Analysis
    International Journal of Advanced Research in Computer Science, 2011
    Co-Authors: Sameer H. Mahant, B.b. Meshram
    Abstract:

    Use of computers for performing crimes is increasing day by day. It has become necessary for Investigator to collect evidences from suspect’s computer. Windows 7 has become mainstream operating system for users and thus its Forensics investigation is becoming important. One of the areas of interest is windows registry. It contains valuable information that can be helpful for the Forensics analysis. Registry contains the basic information like date when Operating System installed, owner name and the advanced information such as the software and hardware devices installed on system, storage devices attached to system, services running on system, history of recently used documents and so on, which will help the analyst to decide the way of further analysis of system depending on the its environment. Though it has such valuable information it is very difficult for an analyst to manually search and analyze it to collect evidences because of its complex structure. So in this paper we presented details of Windows 7 registry, its use for forensic analysis and proposed design for a tool (RegAnalyzer) which will automate task of windows 7 registry analysis for Forensics Investigator so he/she can use it for the further investigation of system. Keywords: computer Forensics; registry Forensics; registry structure; windows 7 Forensics; windows registry

Khawla Alghafli - One of the best experts on this subject based on the ideXlab platform.

  • Forensic Analysis of the Windows 7 Registry
    Journal of Digital Forensics Security and Law, 2010
    Co-Authors: Khawla Alghafli, Andy Jones, Thomas Martin
    Abstract:

    The recovery of digital evidence of crimes from storage media is an increasingly time consuming process as the capacity of the storage media is in a state of constant growth. It is also a difficult and complex task for the forensic Investigator to analyse all of the locations in the storage media. These two factors, when combined, may result in a delay in bringing a case to court. The concept of this paper is to start the initial forensic analysis of the storage media in locations that are most likely to contain digital evidence, the Windows Registry. Consequently, the forensic analysis process and the recovery of digital evidence may take less time than would otherwise be required. In this paper, the Registry structure of Windows 7 is discussed together with several elements of information within the Registry of Windows 7 that may be valuable to a forensic Investigator. These elements were categorized into five groups which are system, application, networks, attached devices and the history lists. We have discussed the values of identified elements to a forensic Investigator. Also, a tool was implemented to perform the function of extracting these elements and presents them in usable form to a Forensics Investigator.

Albabtain Yazeed - One of the best experts on this subject based on the ideXlab platform.

  • Digital Forensics and Security Vulnerabilities in GPU
    'Purdue University (bepress)', 2018
    Co-Authors: Albabtain Yazeed
    Abstract:

    The purpose of this research is to perform a graphics recovery process on the GPU in line with the principles of computer Forensics. The research investigates three different venues in the GPU Forensics field. The first venue targets the recovery of images and web-pages. The researchers tested the possibility of recovering artifacts of last visited web pages and last opened images from the GPUs global memory. The tested types of images are JPEG, TIFF, and BMP graphic file formats of 64x64 pixels, 100x100 pixels, 200x200 pixels, 245x256 pixels, 512x512 pixels, and 1024x1024 pixels in size. Other variables, such as the choice of OS, GPU, and GPU driver, were also tested to measure the effectiveness on the proposed method. The research indicates that recovering artifacts from the GPUs global memory is possible using a set of unique pixel patterns. The research highlights three challenges of implementing forensic techniques on GPUs: 1) elusive global memory allocation scheme of GPUs; 2) varying levels of support for different GPU drivers; and 3) the prerequisite of using certain types of OS and applications. The second venue is GPU video Forensics which investigates the possibility of recovering video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC and GOM video players were used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The recovery process was successful. For 512 x 512 resolution video, the frames were partially recovered but it shows enough information for the Forensics Investigator to determine what was viewed last. The research indicates that it is harder, but not impossible, to obtain a viewable frame from higher-resolution video. The third venue of this research targets the security side of the GPU by reverse engineer a unique family of malware, namely the Win Jelly and the Demon keylogger, that escapes detection by utilizing AMD and NVIDIA Graphics Processing Units (GPUs) as a hideout. Static and dynamic analysis of Win Jelly and Demon were presented to gain a deeper understanding about the behavior of these malware and how they exploit the GPU, two separate techniques were developed using OpenCL and CUDA to completely remove the malware from the GPU and to help avoid future threats. The proposed method and tools successfully removed the malicious files from the GPU without any drawbacks