Live data forensic tool testbed: Proof of concept

Live Data Forensics (LDF) has become a vital means of gathering digital evidence in criminal investigation. Due to advances in technology it is no longer sufficient to merely pull-the-plug instead many systems are analysed while running. However, this means that the evidence that will be relied upon in court is being changed as the LDF techniques are employed. This breaks the fundamental principle of forensics i.e. do not change the evidence. There are certain circumstances in which it is allowed to alter evidence but in these cases the practitioner must be able to explain the implication of their actions. As we are unable to determine how much information changes during LDF it is not possible to fully report the implications.
This paper focuses on the topic of memory forensics and its importance in digital investigations in the context of the evaluation of LDF tools and their footprints. This paper introduces a simulated proof of concept testbed environment which demonstrates the possibility of validating and evaluating the performance of LDF tools. This is achieved through the development of a simulated processor which logs all alterations to memory as they occur. In parallel this paper introduces a specialised instruction set which can be used to trace the execution of the forensic process through RAM. The combination of these allows for the validation of RAM acquisition tools and the determination of the footprint of all LDF tools. The combination of these will, if fully implemented in the future, allow for the comparison of LDF tools in terms of the least impactful on the underlying evidential data. This will in turn lead to better understanding of the consequences of LDF actions and in turn more reliable evidence being available in court.