Evidence Revelations at Memory Forensics in Conversations of Instant Messages
Cheng-Ta Huang；Ya-Ting Chang；Shiuh-Jeng Wang
Forensic Science ； Instant Messaging ； Memory Forensics ； Skype ； Facebook ； Digital Evidence
Forensic Science Journal
|Volume or Term/Year and Month of Publication||
14卷1期（2015 / 12 / 01）
59 - 67
Instant messaging software is typically installed in a Microsoft Windows-based computer. Forensic procedures provide evidence for legal purposes after such software is used. Web-based instant messaging leaves no chat messages on the hard disk but some may be dumped into memory, the paging file and unallocated hard disk space. The targets in this paper are the software ＂Skype＂ and the web version of ＂Facebook Messenger＂ in Windows operating system. Proposed memory forensic technology is used to collect key evidence of communication records and the stepwise process demonstrated. The user’s login username, password, contact list, and conversation records are obtained for the purposes of reconstructing a crime.