A Study: Volatility Forensic on Hidden Files

Abstract: More and more forensic researchers gain findings by live investigating memory volatility. Forensic research on volatile data is nowadays big area of interest. In the early days, investigators pulled the plug, but now it could be very interesting to capture the volatile data of the system. Memory forensics and data carving are among methods that are usually used during volatile investigation. Before pulled the plug, it is often desirable to capture volatile information that may not be recorded in a file system or image backup, such as processes and the contents of memory. This data may hold clues as to the attacker’s identity or the attack methods that were used. However, risks are associated with acquiring information from the live system. Any action performed on the host itself will alter the state of the machine to some extent. In paper, an analysis of hidden process on volatility is conducted