Abstract | Volatile data, being vital to digital investigation, have become part of the standard items targeted in the course of forensic live response to a computer system. In traditional computer forensics where investigation is carried out on a dead system for example, hard disk, data integrity is the first and foremost issue for digital evidence validity in the court of law. In the context of live system forensics, volatile data are acquired from a running system. Due to the ever-changing and volatile nature, it is impossible to verify the integrity of volatile data. Let alone the integrity issue, a more critical problem is the data steadiness, data accuracy and validity of data on the note of proven whether an object found on the volatile memory may be used as evidence in the law court. This digital evidence is related to the data collected on a live system. In this paper, we concentrate on the consistency issue on live systems forensics on the fact that an object may be evidence gathered in the crime scene and can be used as evidence in the court of law. By examining the memory data and the concept of an investigation to determine what is required in an event-based analysis of digital forensics that includes an investigation process model. A physical crime scene data can be used to develop hypotheses and answer questions about an incident or crime. This can be used to argue out an object based evidence of an event. |
---|