Towards a unified agent-based approach for real time computer forensic evidence collection

Document Type

Conference Proceeding

Source of Publication

Proceedings of the 2013 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, ASONAM 2013

Publication Date

1-1-2013

Abstract

In this paper we present preliminary results for a real time computer forensics agent that logs computer activity on a Windows computer system for subsequent forensic investigation. The agent, which is developed using the .NET 2010 framework includes six modules. Each module is dedicated to keep track and record a specific category of user activities. For instance, the Windows Event Watcher logs the Windows OS events and the Removable Devices Detector logs any external devices that are plugged in or removed from a system. Currently, the aforementioned two modules are implemented and tested with carefully designed scenarios using Windows XP and Windows 7 operating systems. Copyright 2013 ACM.

ISBN

9781450322409

Publisher

Association for Computing Machinery

First Page

1492

Last Page

1493

Disciplines

Computer Sciences

Keywords

Social networking (online), Agent-based approach, Computer activities, Forensic evidence, Forensic investigation, Real-time computer, User activity, Windows ossa, Windows XP, Computer forensics

Scopus ID

84893301163

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS