Memory Forensic comparison Volatility and Autopsy

Abstract

The tools being looked at are Autopsy and Volatility. To keep the testing similar all resources will be the same this includes Virtual machine software same amount of CPU cores and Memory dedicated to the Virtual Machine. The Virtual machines that will be used to conduct tests are Kali Linux and Windows 10. Careful consideration was taking into place so that each tool was supported by each operating system. Each test will be using the same memory payload for each tool. Volatility was found not to have that much of a difference between the Kali and Windows 10 VM. Both versions of Volatility performed the same. This includes the Syntax and how you run the program. For Autopsy both versions are vastly different. The Linux version uses a web interface opposed to the Windows version. The Windows version also displays more data and can support more form of forensic evidence. Its best to use the windows version of Autopsy. And for Volatility it comes down to self-preference Kali Linux or Windows.