Evidence Revelations at Memory Forensics in Conversations of Instant Messages




Cheng-Ta Huang;Ya-Ting Chang;Shiuh-Jeng Wang

Key Words

Forensic Science ; Instant Messaging ; Memory Forensics ; Skype ; Facebook ; Digital Evidence


Forensic Science Journal

Volume or Term/Year and Month of Publication

14卷1期(2015 / 12 / 01)

Page #

59 - 67

Content Language


English Abstract

Instant messaging software is typically installed in a Microsoft Windows-based computer. Forensic procedures provide evidence for legal purposes after such software is used. Web-based instant messaging leaves no chat messages on the hard disk but some may be dumped into memory, the paging file and unallocated hard disk space. The targets in this paper are the software "Skype" and the web version of "Facebook Messenger" in Windows operating system. Proposed memory forensic technology is used to collect key evidence of communication records and the stepwise process demonstrated. The user’s login username, password, contact list, and conversation records are obtained for the purposes of reconstructing a crime.

Topic Category 醫藥衛生 > 基礎醫學