摘要
Memory analysis is one of the key techniques in computer live forensics. Especially,the analysis of a Mac OS X operating system's memory image file plays an important role in identifying the running status of an apple computer. However,how to analyze the image file without using extra"mach-kernel"file is one of the unsolved difficulties. In this paper,we firstly compare several approaches for physical memory acquisition and analyze the effects of each approach on physical memory. Then,we discuss the traditional methods for the physical memory file analysis of Mac OS X. A novel physical memory image file analysis approach without using extra"mach-kernel"file is proposed base on the discussion. We verify the performance of the new approach on Mac OS X 10. 8. 2. The experimental results show that the proposed approach is simpler and more practical than previous ones.
Memory analysis is one of the key techniques in computer live forensics. Especially, the analysis of a Mac OS X operating system' s memory image file plays an important role in identifying the running status of an apple computer. However, how to analyze the image file without using extra" roach_ kernel" file is one of the unsolved difficulties. In this paper, we firstly compare several approaches for physical memory acquisition and analyze the effects of each approach on physical memory. Then, we discuss the traditional methods for the physical memory file analysis of Mac OS X. A novel physical memory image file analysis approach without using extra" mach_kernel" file is proposed base on the discussion. We verify the performance of the new approach on Mac OS X 10. 8. 2. The experimental results show that the proposed approach is simpler and more practical than previous ones.
基金
Sponsored by the National Natural Science Foundation of China (Grant No.61303199)
Natural Science Foundation of Shandong Province (Grant No.ZR2013FQ001 and ZR2011FQ030)
Outstanding Research Award Fund for Young Scientists of Shandong Province (Grant No.BS2013DX010)
Academy of Sciences Youth Fund Project of Shandong Province (Grant No.2013QN007)