• Title/Summary/Keyword: Memory Forensics

Search Result 32, Processing Time 0.015 seconds

Cold Boot Attack on Encrypted Containers for Forensic Investigations

  • Twum, Frimpong;Lagoh, Emmanuel Mawuli;Missah, Yaw;Ussiph, Najim;Ahene, Emmanuel
    • KSII Transactions on Internet and Information Systems (TIIS)
    • /
    • v.16 no.9
    • /
    • pp.3068-3086
    • /
    • 2022
  • Digital Forensics is gaining popularity in adjudication of criminal cases as use of electronic gadgets in committing crime has risen. Traditional approach to collecting digital evidence falls short when the disk is encrypted. Encryption keys are often stored in RAM when computer is running. An approach to acquire forensic data from RAM when the computer is shut down is proposed. The approach requires that the investigator immediately cools the RAM and transplant it into a host computer provisioned with a tool developed based on cold boot concept to acquire the RAM image. Observation of data obtained from the acquired image compared to the data loaded into memory shows the RAM chips exhibit some level of remanence which allows their content to persist after shutdown which is contrary to accepted knowledge that RAM loses its content immediately there is power cut. Results from experimental setups conducted with three different RAM chips labeled System A, B and C showed at a reduced temperature of -25C, the content suffered decay of 2.125% in 240 seconds, 0.975% in 120 seconds and 1.225% in 300 seconds respectively. Whereas at operating temperature of 25℃, there was decay of 82.33% in 60 seconds, 80.31% in 60 seconds and 95.27% in 120 seconds respectively. The content of RAM suffered significant decay within two minutes without power supply at operating temperature while at a reduced temperature less than 5% decay was observed. The findings show data can be recovered for forensic evidence even if the culprit shuts down the computer.

Estimation of reaction forces at the seabed anchor of the submerged floating tunnel using structural pattern recognition

  • Seongi Min;Kiwon Jeong;Yunwoo Lee;Donghwi Jung;Seungjun Kim
    • Computers and Concrete
    • /
    • v.31 no.5
    • /
    • pp.405-417
    • /
    • 2023
  • The submerged floating tunnel (SFT) is tethered by mooring lines anchored to the seabed, therefore, the structural integrity of the anchor should be sensitively managed. Despite their importance, reaction forces cannot be simply measured by attaching sensors or load cells because of the structural and environmental characteristics of the submerged structure. Therefore, we propose an effective method for estimating the reaction forces at the seabed anchor of a submerged floating tunnel using a structural pattern model. First, a structural pattern model is established to use the correlation between tunnel motion and anchor reactions via a deep learning algorithm. Once the pattern model is established, it is directly used to estimate the reaction forces by inputting the tunnel motion data, which can be directly measured inside the tunnel. Because the sequential characteristics of responses in the time domain should be considered, the long short-term memory (LSTM) algorithm is mainly used to recognize structural behavioral patterns. Using hydrodynamics-based simulations, big data on the structural behavior of the SFT under various waves were generated, and the prepared datasets were used to validate the proposed method. The simulation-based validation results clearly show that the proposed method can precisely estimate time-series reactions using only acceleration data. In addition to real-time structural health monitoring, the proposed method can be useful for forensics when an unexpected accident or failure is related to the seabed anchors of the SFT.