Search for: All records

Memory Forensics is one of the most important emerging areas in computer forensics. In memory forensics, analysis of userland memory is a technique that analyses per-process runtime data structures and extracts significant evidence for application-specific investigations. In this research, our focus is to examine the critical challenges faced by process memory acquisition that can impact object and data recovery. Particularly, this research work seeks to address the issues of consistency and reliability in userland memory forensics on Android. In real-world investigations, memory acquisition tools record the information when the device is running. In such scenarios, each application’s memory content may be in flux due to updates that are in progress, garbage collection activities, changes in process states, etc. In this paper we focus on various runtime activities such as garbage collection and process states and the impact they have on object recovery in userland memory forensics. The outcome of the research objective is to assess the reliability of Android userland memory forensic tools by providing new research directions for efficiently developing a metric study to measure the reliability. We evaluated our research objective by analysing memory dumps acquired from 30 apps in different Process Acquisition Modes. The Process Acquisition Mode (PAM) is the memory dump of a process that is extracted while external runtime factors are triggered. Our research identified an inconsistency in the number of objects recovered from analysing the process memory dumps with runtime factors included. Particularly, the evaluation results revealed differences in the count of objects recovered in different acquisition modes. We utilized Euclidean distance and covariance as the metrics for our study. These two metrics enabled the authors to identify how the change in the number of recovered objects in PAM impact forensic analysis. Our conclusion revealed that runtime factors could on average result in about 20% data loss, thus revealing these factors can have an obvious impact on object recovery. 

Abstract In van der Holst et al. (2019), we modeled the solar corona and inner heliosphere of the first encounter of NASA’s Parker Solar Probe (PSP) using the Alfvén Wave Solar atmosphere Model (AWSoM) with Air Force Data Assimilative Photospheric flux Transport–Global Oscillation Network Group magnetograms, and made predictions of the state of the solar wind plasma for the first encounter. AWSoM uses low-frequency Alfvén wave turbulence to address the coronal heating and acceleration. Here, we revise our simulations, by introducing improvements in the energy partitioning of the wave dissipation to the electron and anisotropic proton heating and using a better grid design. We compare the new AWSoM results with the PSP data and find improved agreement with the magnetic field, turbulence level, and parallel proton plasma beta. To deduce the sources of the solar wind observed by PSP, we use the AWSoM model to determine the field line connectivity between PSP locations near the perihelion at 2018 November 6 UT 03:27 and the solar surface. Close to the perihelion, the field lines trace back to a negative-polarity region about the equator. 

Abstract The hot and diffuse nature of the Sun’s extended atmosphere allows it to persist in non-equilibrium states for long enough that wave–particle instabilities can arise and modify the evolution of the expanding solar wind. Determining which instabilities arise, and how significant a role they play in governing the dynamics of the solar wind, has been a decades-long process involving in situ observations at a variety of radial distances. With new measurements from the Parker Solar Probe (PSP), we can study what wave modes are driven near the Sun, and calculate what instabilities are predicted for different models of the underlying particle populations. We model two hours-long intervals of PSP/SPAN-i measurements of the proton phase-space density during the PSP’s fourth perihelion with the Sun using two commonly used descriptions for the underlying velocity distribution. The linear stability and growth rates associated with the two models are calculated and compared. We find that both selected intervals are susceptible to resonant instabilities, though the growth rates and kinds of modes driven unstable vary depending on whether the protons are modeled using one or two components. In some cases, the predicted growth rates are large enough to compete with other dynamic processes, such as the nonlinear turbulent transfer of energy, in contrast with relatively slower instabilities at larger radial distances from the Sun. 

Context. The first encounters of Parker Solar Probe (PSP) with the Sun revealed the presence of ubiquitous localised magnetic deflections in the inner heliosphere; these structures, often called switchbacks, are particularly striking in solar wind streams originating from coronal holes. Aims. We report the direct piece of evidence for magnetic reconnection occurring at the boundaries of three switchbacks crossed by PSP at a distance of 45 to 48 solar radii to the Sun during its first encounter. Methods. We analyse the magnetic field and plasma parameters from the FIELDS and Solar Wind Electrons Alphas and Protons instruments. Results. The three structures analysed all show typical signatures of magnetic reconnection. The ion velocity and magnetic field are first correlated and then anti-correlated at the inbound and outbound edges of the bifurcated current sheets with a central ion flow jet. Most of the reconnection events have a strong guide field and moderate magnetic shear, but one current sheet shows indications of quasi anti-parallel reconnection in conjunction with a magnetic field magnitude decrease by 90%. Conclusions. Given the wealth of intense current sheets observed by PSP, reconnection at switchback boundaries appears to be rare. However, as the switchback boundaries accomodate currents, one can conjecture that the geometry of these boundaries offers favourable conditions for magnetic reconnection to occur. Such a mechanism would thus contribute in reconfiguring the magnetic field of the switchbacks, affecting the dynamics of the solar wind and eventually contributing to the blending of the structures with the regular wind as they propagate away from the Sun. 

Context. Aims. We systematically search for magnetic flux rope structures in the solar wind to within the closest distance to the Sun of ~0.13 AU, using data from the third and fourth orbits of the Parker Solar Probe. Methods. We extended our previous magnetic helicity-based technique of identifying magnetic flux rope structures. The method was improved upon to incorporate the azimuthal flow, which becomes larger as the spacecraft approaches the Sun. Results. A total of 21 and 34 magnetic flux ropes are identified during the third (21-day period) and fourth (17-day period) orbits of the Parker Solar Probe, respectively. We provide a statistical analysis of the identified structures, including their relation to the streamer belt and heliospheric current sheet crossing.