Memory Forensic comparison Volatility and Autopsy

Date
2021-11
Authors
Soto, Max Kaeo
Contributor
Advisor
Department
Instructor
Depositor
Speaker
Researcher
Consultant
Interviewer
Annotator
Journal Title
Journal ISSN
Volume Title
Publisher
University of Hawaiʻi — West Oʻahu
Volume
Number/Issue
Starting Page
Ending Page
Alternative Title
Abstract
The tools being looked at are Autopsy and Volatility. To keep the testing similar all resources will be the same this includes Virtual machine software same amount of CPU cores and Memory dedicated to the Virtual Machine. The Virtual machines that will be used to conduct tests are Kali Linux and Windows 10. Careful consideration was taking into place so that each tool was supported by each operating system. Each test will be using the same memory payload for each tool. Volatility was found not to have that much of a difference between the Kali and Windows 10 VM. Both versions of Volatility performed the same. This includes the Syntax and how you run the program. For Autopsy both versions are vastly different. The Linux version uses a web interface opposed to the Windows version. The Windows version also displays more data and can support more form of forensic evidence. Its best to use the windows version of Autopsy. And for Volatility it comes down to self-preference Kali Linux or Windows.
Description
A student presentation to the Fall 2021 Student Research and Creative Works Symposium
Keywords
Citation
Extent
1 page
Format
Geographic Location
Time Period
Related To
Table of Contents
Rights
Attribution-NonCommercial-NoDerivs 3.0 United States
Rights Holder
Local Contexts
Email libraryada-l@lists.hawaii.edu if you need this content in ADA-compliant format.