Towards a unified agent-based approach for real time computer forensic evidence collection
Source of Publication
Proceedings of the 2013 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, ASONAM 2013
In this paper we present preliminary results for a real time computer forensics agent that logs computer activity on a Windows computer system for subsequent forensic investigation. The agent, which is developed using the .NET 2010 framework includes six modules. Each module is dedicated to keep track and record a specific category of user activities. For instance, the Windows Event Watcher logs the Windows OS events and the Removable Devices Detector logs any external devices that are plugged in or removed from a system. Currently, the aforementioned two modules are implemented and tested with carefully designed scenarios using Windows XP and Windows 7 operating systems. Copyright 2013 ACM.
Awawdeh, Shadi Al; Baggili, Ibrahim; Marrington, Andrew; and Iqbal, Farkhund, "Towards a unified agent-based approach for real time computer forensic evidence collection" (2013). Scopus Indexed Articles. 1964.