Copyright (c) 2022 Publicaciones e Investigación
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
When the Publicaciones e Investigaciones Journal receives an original study or article from its author(s), whether by email, postal service, or the platforms available for said purpose, know that it may be published in physical or electronic formats in national or international archives, databases, or SIRES. As such, Publications and Research authorizes the reproduction and citation of said material, provided that the description of information is carried out in conformity with bibliographic norms, and mention the corresponding names, authors, article, issue, and pages. Publications and Research, in advance, expresses that the information, concepts, and methods are the responsibility of the author(s). As such, the UNAD does not have any influence whatsoever over that expressed in the manuscript.
Evaluation of free software tools, for the Windows operating system, in the acquisition of RAM memory evidences.
The objective of this article, is to evaluate free software tools of the Windows operating system, for the acquisition of evidence of RAM memory, using the ISO/IEC 25010 standard that defines characteristics and measures of quality of use of a product. The above takes into consideration the technical form for RAM dump analysis and the use of the specific tools DumpIt, FTK Imager, Windows Forensic Toolchest (WFT), OS Forensic and RamCapturer.
In order to guarantee the usefulness of the selected tools, it is contemplated to define, classify, identify, obtain, analyze and interpret results obtained with the Volatility tool, and thus be able to detect which instrument recovers more, the most efficient one that affects the evidence less. The latter is of utmost importance, since a very subtle alteration could change the HASH obtaining large scale problems in a trial.
How to Cite
