Analyzing and searching process of internet username and password stored in Random Access Memory (RAM)

摘要

This paper develops a technique to gather and analyze username and password stored in a physical memory or RAM (Random Access Memory). A live memory forensic investigator is able to use this work in order to find the pattern as the “Searching Criteria” for extending the search to other artifacts. The proposed technique uses a quick search algorithm to find the data in the physical memory. By using a proposed technique to harvest username and password from some popular websites, the experiment has been tested by browsing to social network, webmail, internet banking, and some business online shopping websites. Form the artifacts recovered from the physical memory, we find many useful evidences of username and password that are stored in a plaintext format. Finally, these recover evidences can be linked to other artifact.