A partially reconstructed previous Gmail session by live digital evidences investigation through volatile data acquisition

作者：Chu Hai Cheng; Yang Szu Wei; Park Jong Hyuk^*

来源：Security and Communication Networks, 2012, 5(10): 1193-1198.

DOI：10.1002/sec.511

• digital evidence
• Gmail session reconstruction
• volatile memory acquisition
• digital forensics

The essence of this paper is to illustrate live data acquisition within the random access memory of a notebook trying to utilize the collected digital evidences in order to partially reconstruct previous Gmail session, which could be probative digital evidence in a court of law. The proposed framework is essentially crucial for the investigation of certain related cybercrimes on the basis of the digital breadcrumb trails being professionally disclosed and appropriately handled. Without loss of generality, the volatile data would vanish forever when the power of the computing devices is no longer sustainable. This research pinpoints the imminent threat of IT savvy cyber criminals and the corresponding counter procedures used to crack criminal cases if web-based e-mail utilities are essentially involved. This paper is focused on the prevalent e-mail utility, Gmail, as the research subject. At last, live digital evidence acquisition must be accurately fulfilled before the seizure of the computing devices in the crime scene to avoid irreversible investigation procedures which mean the digital evidences could be deleted, resulting in the loss of probative evidence.

• 出版日期2012-10