Please use this identifier to cite or link to this item:

Memory Forensic comparison Volatility and Autopsy

File Size Format  
ssym-fall2021-0020.pdf 521.03 kB Adobe PDF View/Open

Item Summary

Title:Memory Forensic comparison Volatility and Autopsy
Authors:Soto, Max Kaeo
Date Issued:Nov 2021
Publisher:University of Hawaiʻi — West Oʻahu
Abstract:The tools being looked at are Autopsy and Volatility. To keep the testing similar all resources will be the same this includes Virtual machine software same amount of CPU cores and Memory dedicated to the Virtual Machine. The Virtual machines that will be used to conduct tests are Kali Linux and Windows 10. Careful consideration was taking into place so that each tool was supported by each operating system. Each test will be using the same memory payload for each tool. Volatility was found not to have that much of a difference between the Kali and Windows 10 VM. Both versions of Volatility performed the same. This includes the Syntax and how you run the program. For Autopsy both versions are vastly different. The Linux version uses a web interface opposed to the Windows version. The Windows version also displays more data and can support more form of forensic evidence. Its best to use the windows version of Autopsy. And for Volatility it comes down to self-preference Kali Linux or Windows.
Description:A student presentation to the Fall 2021 Student Research and Creative Works Symposium
Pages/Duration:1 page
Rights:Attribution-NonCommercial-NoDerivs 3.0 United States
Appears in Collections: Student Research Symposium

Please email if you need this content in ADA-compliant format.

This item is licensed under a Creative Commons License Creative Commons