Gathering and Storage Technique Implementation of Volatility Memory Data for Real-Forensic

摘要

Digital Evidence has a property like independence, invisibility, expertise, enormousness, fragility and others of a medium, which are different from the existing physical evidence. To use this as evidence, the authenticity, integrity, credibility and originality should be guaranteed so that the Digital Evidence collected from a computer or storage device may have a legal effect. Especially, as the medium to become legally effective for real-time digital information has the property of independence and invisibility, in respect of the collection of volatility memory data and the data stored, they should be submitted after transforming them into a visible form. In this study, I am going to apply a technology that collects and stores the volatility memory data that generate in real time by analyzing the storage method of a register that is variously applied at the time of CPU designing.