Search for: All records

Memory Forensics is one of the most important emerging areas in computer forensics. In memory forensics, analysis of userland memory is a technique that analyses per-process runtime data structures and extracts significant evidence for application-specific investigations. In this research, our focus is to examine the critical challenges faced by process memory acquisition that can impact object and data recovery. Particularly, this research work seeks to address the issues of consistency and reliability in userland memory forensics on Android. In real-world investigations, memory acquisition tools record the information when the device is running. In such scenarios, each application’s memory content may be in flux due to updates that are in progress, garbage collection activities, changes in process states, etc. In this paper we focus on various runtime activities such as garbage collection and process states and the impact they have on object recovery in userland memory forensics. The outcome of the research objective is to assess the reliability of Android userland memory forensic tools by providing new research directions for efficiently developing a metric study to measure the reliability. We evaluated our research objective by analysing memory dumps acquired from 30 apps in different Process Acquisition Modes. The Process Acquisition Mode (PAM) is the memory dump of a process that is extracted while external runtime factors are triggered. Our research identified an inconsistency in the number of objects recovered from analysing the process memory dumps with runtime factors included. Particularly, the evaluation results revealed differences in the count of objects recovered in different acquisition modes. We utilized Euclidean distance and covariance as the metrics for our study. These two metrics enabled the authors to identify how the change in the number of recovered objects in PAM impact forensic analysis. Our conclusion revealed that runtime factors could on average result in about 20% data loss, thus revealing these factors can have an obvious impact on object recovery. 

Abstract In van der Holst et al. (2019), we modeled the solar corona and inner heliosphere of the first encounter of NASA’s Parker Solar Probe (PSP) using the Alfvén Wave Solar atmosphere Model (AWSoM) with Air Force Data Assimilative Photospheric flux Transport–Global Oscillation Network Group magnetograms, and made predictions of the state of the solar wind plasma for the first encounter. AWSoM uses low-frequency Alfvén wave turbulence to address the coronal heating and acceleration. Here, we revise our simulations, by introducing improvements in the energy partitioning of the wave dissipation to the electron and anisotropic proton heating and using a better grid design. We compare the new AWSoM results with the PSP data and find improved agreement with the magnetic field, turbulence level, and parallel proton plasma beta. To deduce the sources of the solar wind observed by PSP, we use the AWSoM model to determine the field line connectivity between PSP locations near the perihelion at 2018 November 6 UT 03:27 and the solar surface. Close to the perihelion, the field lines trace back to a negative-polarity region about the equator. 

Abstract The hot and diffuse nature of the Sun’s extended atmosphere allows it to persist in non-equilibrium states for long enough that wave–particle instabilities can arise and modify the evolution of the expanding solar wind. Determining which instabilities arise, and how significant a role they play in governing the dynamics of the solar wind, has been a decades-long process involving in situ observations at a variety of radial distances. With new measurements from the Parker Solar Probe (PSP), we can study what wave modes are driven near the Sun, and calculate what instabilities are predicted for different models of the underlying particle populations. We model two hours-long intervals of PSP/SPAN-i measurements of the proton phase-space density during the PSP’s fourth perihelion with the Sun using two commonly used descriptions for the underlying velocity distribution. The linear stability and growth rates associated with the two models are calculated and compared. We find that both selected intervals are susceptible to resonant instabilities, though the growth rates and kinds of modes driven unstable vary depending on whether the protons are modeled using one or two components. In some cases, the predicted growth rates are large enough to compete with other dynamic processes, such as the nonlinear turbulent transfer of energy, in contrast with relatively slower instabilities at larger radial distances from the Sun.