Difference between pages "Windows Memory Analysis" and "Cell phone forensics bibliography"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Initial description. Needs help.)
 
(Category:Bibliographies)
 
Line 1: Line 1:
 +
==Academic Publications==
 +
; [http://www.waset.org/pwaset/v26/v26-6.pdf Data Acquisition from Cell Phone using Logical Approach], Keonwoo Kim, Dowon Hong, Kyoil Chung, and Jae-Cheol Ryou, PROCEEDINGS OF WORLD ACADEMY OF SCIENCE, ENGINEERING AND TECHNOLOGY VOLUME 26 DECEMBER 2007 ISSN 1307-6884
 +
: This article discusses three approaches for acquiring data from cell phones: physically removing the flash RAM chips and reading them directly; reading the data out using the [[JTAG]] interface, and running software on the cell phone to extract the files at a logical level. The authors have built a logical extraction system and are working on a system based on JTAG.
  
== History ==
+
; [http://portal.acm.org/citation.cfm?id=1363257 Forensics for Korean cell phone], Keonwoo Kim, Dowon Hong and Kyoil Chung, Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop, Adelaide, Australia, 2008.
During the 1990s, it became a [[best practice]] to capture a [[Tools:Memory_Imaging|memory image]] during incident response. At the time, the only way to analyze such memory images was using [[strings]]. Although this method could reveal interesting details about the memory image, there was no way to associate what data came from what program, let alone what user.  
+
  
In the summer 2005 the [[DFRWS||Digital Forensics Research Workshop]] published a Memory Analysis Challenge. They distributed two memory images and asked researchers to answer a number of questions about a security incident. The challenge produced two seminal works. The first, by Chris Betz, introduced a tool called (NAME). The second, by George Garner and (AUTHOR) produced kntlist.
+
; [http://www.ssddfj.org/papers/SSDDFJ_V2_1_Luck_Stokes.pdf An Integrated Approach to Recovering Deleted Files from NAND Flash Data], James Luck & Mark Stokes, SMALL SCALE DIGITAL DEVICE FORENSICS JOURNAL, VOL. 2, NO. 1, JUNE 2008 ISSN# 1941-6164
 +
 
 +
==US Government Publications==
 +
; [http://csrc.nist.gov/publications/nistpubs/800-101/SP800-101.pdf Guidelines on Cell Phone Forensics] (NIST SP 800-101), May 2007
 +
; [http://csrc.nist.gov/publications/nistir/nistir-7250.pdf Cell Phone Forensic Tools: An Overview and Analysis] (NISTIR 7250)
 +
; [http://csrc.nist.gov/publications/nistir/nistir-7100-PDAForensics.pdf PDA Forensic Tools: An Overview and Analysis] (NISTIR 7100)
 +
 
 +
 
 +
[[Category:Bibliographies]]

Latest revision as of 13:54, 15 November 2008

Academic Publications

Data Acquisition from Cell Phone using Logical Approach, Keonwoo Kim, Dowon Hong, Kyoil Chung, and Jae-Cheol Ryou, PROCEEDINGS OF WORLD ACADEMY OF SCIENCE, ENGINEERING AND TECHNOLOGY VOLUME 26 DECEMBER 2007 ISSN 1307-6884
This article discusses three approaches for acquiring data from cell phones: physically removing the flash RAM chips and reading them directly; reading the data out using the JTAG interface, and running software on the cell phone to extract the files at a logical level. The authors have built a logical extraction system and are working on a system based on JTAG.
Forensics for Korean cell phone, Keonwoo Kim, Dowon Hong and Kyoil Chung, Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop, Adelaide, Australia, 2008.
An Integrated Approach to Recovering Deleted Files from NAND Flash Data, James Luck & Mark Stokes, SMALL SCALE DIGITAL DEVICE FORENSICS JOURNAL, VOL. 2, NO. 1, JUNE 2008 ISSN# 1941-6164

US Government Publications

Guidelines on Cell Phone Forensics (NIST SP 800-101), May 2007
Cell Phone Forensic Tools: An Overview and Analysis (NISTIR 7250)
PDA Forensic Tools: An Overview and Analysis (NISTIR 7100)