FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory

Digital Investigation(2006)

引用 152|浏览0
暂无评分
摘要
We present the Forensic Analysis ToolKit (FATKit) - a modular, extensible framework that increases the practical applicability of volatile memory forensic analysis by freeing human analysts from the prohibitively-tedious aspects of low-level data extraction. FATKit allows analysts to focus on higher-level tasks by providing novel methods for automatically deriving digital object definitions from C source code, extracting those objects from memory images, and visualizing the underlying data in various ways. FATKit presently includes modules for general virtual address space reconstruction and visualization, as well as Linux- and Windows-specific kernel analysis.
更多
查看译文
关键词
source code,computer forensics,digital forensics
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要