An Approach to Analyze Physical Memory Image File of Mac OS X
Li-Juan Xu, Lian-Hai Wang
(Shandong Provincial Key Laboratory of Computer Network, Shandong Computer Science Center(National Supercomputer Center in Jinan), Jinan 250101, China)
Abstract:
Memory analysis is one of the key techniques in computer live forensics. Especially, the analysis of a Mac OS X operating system’s memory image file plays an important role in identifying the running status of an apple computer. However, how to analyze the image file without using extra”mach-kernel” file is one of the unsolved difficulties. In this paper, we firstly compare several approaches for physical memory acquisition and analyze the effects of each approach on physical memory. Then, we discuss the traditional methods for the physical memory file analysis of Mac OS X. A novel physical memory image file analysis approach without using extra“mach-kernel” file is proposed base on the discussion. We verify the performance of the new approach on Mac OS X 10.8.2. The experimental results show that the proposed approach is simpler and more practical than previous ones.
Key words: computer forensics live forensics Mac OS X operating system physical memory analysis
DOI：10.11916/j.issn.1005-9113.2014.04.018
Clc Number:TP309
Fund:
删除或更新信息，请邮件至freekaoyan#163.com(#换成@)
An Approach to Analyze Physical Memory Image File of Mac OS X
本站小编 哈尔滨工业大学/2019-10-23
相关话题/An Approach to Analyze Physical
领限时大额优惠券,享本站正版考研考试资料!
优惠券领取后72小时内有效，10万种最新考研考试考证类电子打印资料任你选。涵盖全国500余所院校考研专业课、200多种职业资格考试、1100多种经典教材，产品类型包含电子书、题库、全套资料以及视频，无论您是考研复习、考证刷题，还是考前冲刺等，不同类型的产品可满足您学习上的不同需求。 ...考试优惠券 本站小编 Free壹佰分学习网 2022-09-19Morphology Similarity Distance for Bearing Fault Diagnosis Based on Multi-Scale Permutation Entropy
Morphology Similarity Distance for Bearing Fault Diagnosis Based on Multi-Scale Permutation Entropy Author NameAffiliationJinbao ZhangSchool of Mechatronics Engineering, Harbin Institute of Technology, Harbin 150001, ChinaYongqiang ZhaoSchool of Mechatronics Engineering, Har ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Influence of Si Contents on the Microstructure Evolution and Mechanical Properties of Al-Mg-Si-Cu-Zn
Influence of Si Contents on the Microstructure Evolution and Mechanical Properties of Al-Mg-Si-Cu-Zn Alloys Author NameAffiliationLiang ZhuState Key Laboratory for Advanced Metals and Materials, University of Science and Technology Beijing, Beijing 100083, ChinaMingxing GuoS ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Role of Composite Phase Change Material on the Thermal Performance of a Latent Heat Storage System:
Role of Composite Phase Change Material on the Thermal Performance of a Latent Heat Storage System: Experimental Investigation Author NameAffiliationJasim AbdulateefDepartment of Mechanical Engineering, University of Diyala, Baquba 32001, IraqAhmed F. HasanDepartment of Chem ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05GEO Satellite Thruster Configuration and Optimization
GEO Satellite Thruster Configuration and Optimization Author NameAffiliationJiajia FengBeijing Institute of Control Engineering, Beijing 100190, ChinaScience and Technology on Space Intelligent Control Laboratory,Beijing 100190,ChinaZuowei WangBeijing Institute of Control En ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Disturbance Observer Design with a Bode’s Ideal Filter for Sigma-Delta Modulators
Disturbance Observer Design with a Bode’s Ideal Filter for Sigma-Delta Modulators Author NameAffiliationChi XuCollege of Information Science and Technology, Beijing University of Chemical Technology, Beijing 100029, China Advanced Innovation Center for Soft Matter, Beijing U ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Hidden Attractors in a Delayed Memristive Differential System with Fractional Order and Chaos Synchr
Hidden Attractors in a Delayed Memristive Differential System with Fractional Order and Chaos Synchronization Author NameAffiliationDawei DingSchool of Electronics and Information Engineering, Anhui University, Hefei 230601, ChinaKey Laboratory of Intelligent Computing and S ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Vibration Absorption Efficiency and Higher Branches Elimination of Variable-Stiffness Nonlinear Ener
Vibration Absorption Efficiency and Higher Branches Elimination of Variable-Stiffness Nonlinear Energy Sink Author NameAffiliationRui ZhongTianjin Key Laboratory of the Design and Intelligent Control of the Advanced Mechatronical System, Tianjin University of Technology,Tian ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Probability Response of Shape Memory Alloy Beam Subjected to Noise Excitation
Probability Response of Shape Memory Alloy Beam Subjected to Noise Excitation Author NameAffiliationYuting LiSchool of Science, Xi’an Polytechnic University, Xi’an 710000, ChinaJinqian FengSchool of Science, Xi’an Polytechnic University, Xi’an 710000, ChinaYingxiao WangSchoo ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Heat Dissipation Performance of Metal Core Printed Circuit Board with Micro Heat Exchanger
Heat Dissipation Performance of Metal Core Printed Circuit Board with Micro Heat Exchanger Author NameAffiliationDiancheng QinGuangdong LED Packaging-Used Heat Dissipation Substrate Engineering Technology Research Center, Zhuhai 519180, Guangdong,ChinaKewei LiangRayben Techn ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05Biodegradation of Ammonia Nitrogen Using a Novel Candida sp. Strain N6 Immobilization
Biodegradation of Ammonia Nitrogen Using a Novel Candida sp. Strain N6 Immobilization Author NameAffiliationKai WangSchool of Marine Science and Technology, Harbin Institute of Technology, Weihai,Weihai 264209, Shandong, ChinaSchool of Municipal and Environmental Engineering ...哈尔滨工业大学科研学术 本站小编 哈尔滨工业大学 2020-12-05
