Recovery of live evidence from internet applications

Abstract

Advanced internet technologies providing services like e-mail, social networking, online banking, online shopping etc., have made day-to-day activities simple and convenient. Increasing dependency on the internet, convenience, and decreasing cost of electronic devices have resulted in frequent use of online services. However, increased indulgence in the internet by people has also accelerated the pace of digital crimes. The increase in number and complexity of digital crime cases has caught the attention of forensic investigators. The Digital Investigators are faced with the challenge of gathering accurate digital evidence from as many sources as possible. In this paper, an attempt was made to recover digital evidence from a system's RAM in the form of information about the most recent browsing session of the user. Four different applications were chosen for the experiment and it was found that crucial information about the target user such as, user name, passwords, etc., was recoverable. © 2012 Springer-Verlag GmbH.