The Research on Linux Memory Forensics

摘要：

　　Memory forensics is a branch of computer forensics.It does not depend on the operating system API,and analyzes operating system information from binary memory data.Based on the 64-bit Linux operating system,it analyzes system process and thread information from physical memory data.Using ELF file debugging information and propose a method for locating kernel structure member variable,it can be applied to different versions of the Linux operating system.The experimental results show that the method can successfully obtain the sytem process information from physical memory data,and can be compatible with multiple versions of the Linux kernel.

作者: Jun Zhang ShengBing Che

作者单位: School of Central South University of Forestry and Technology,ChangSha,China

会议类型: 国际会议

会议名称: 2017 International Symposium on Application of Materials Science and Energy Materials (SAMSE 2017) (2017材料科学应用与能源材料国际研讨会)

会议地点: 上海

会议语种:英文

页码: 1-6

在线出版日期: 2017-12-28（万方平台首次上网日期，不代表论文的发表时间）