Evidence Revelations at Memory Forensics in Conversations of Instant Messages

Cheng-Ta Huang ； Ya-Ting Chang ； Shiuh-Jeng Wang

《Forensic Science Journal》 14卷1期 (2015/12) Pp. 59-67

https://doi.org/10.6593/FSJ.2015.1401.05

並列摘要

Instant messaging software is typically installed in a Microsoft Windows-based computer. Forensic procedures provide evidence for legal purposes after such software is used. Web-based instant messaging leaves no chat messages on the hard disk but some may be dumped into memory, the paging file and unallocated hard disk space. The targets in this paper are the software ＂Skype＂ and the web version of ＂Facebook Messenger＂ in Windows operating system. Proposed memory forensic technology is used to collect key evidence of communication records and the stepwise process demonstrated. The user’s login username, password, contact list, and conversation records are obtained for the purposes of reconstructing a crime.

並列關鍵字

Forensic Science ； Instant Messaging ； Memory Forensics ； Skype ； Facebook ； Digital Evidence