Development of Kernel Mode RAM Driver for RAM Image on Windows

Ahmet Ali SÜZEN; Kubilay TAŞDELEN; Ecir Uğur KÜÇÜKSİLLE

doi:https://doi.org/10.19113/sdufenbed.529039

Makale detayları

Development of Kernel Mode RAM Driver for RAM Image on Windows

Yazarlar:

Ahmet Ali SÜZEN | Kubilay TAŞDELEN | Ecir Uğur KÜÇÜKSİLLE

Yayıncı:

Süleyman Demirel University

Ana Başlıklar:

Uygulamalı fizik

Dergi:

Süleyman Demirel University Journal of Natural and Applied Sciences 2019 Vol.23 Issue 2, pp.498-504

Belge Tipi:

Makale

Yayın Tarihi:

8/2019

Belge Dili:

İngilizce

Document ID (Org No.):

2000553327

Sıklık:

Üç Yıllık

eISSN:

1308-6529

DOI:

https://doi.org/10.19113/sdufenbed.529039

Özet:

 


In the
field of computer forensics live analysis through immediate intervention is an
important way of gathering electronic evidence. The way to obtain evidence from
volatile data using live analysis is to take an image of the RAM (Random Access
Memory). The entire RAM has to be copied in order to import data from this
image. However, since the user mode is the default mode in Windows operating
systems only the running processes can be accessed.  Therefore, RAM imaging software needs to work
at Kernel Mode level. In this study, a RAM driver was developed using WDK
(Window Driver Kit) to enable RAM imaging software to run in Kernel Mode. The
developed driver works on Windows 8, 8.1 and 10 (32 bit and 64 bit) operating
systems. Virtual addresses, physical addresses and table pages for RAM can be
accessed using the developed RAM driver. In this way, image acquisition
software using this driver is able to carry out bit-to-bit copying of RAM. In
addition, a program to import a RAM image in c ++ using this driver has also
been developed. When the image retrieval software is installed in RAM it
occupies a meager 156 KB of space. Compared to the existing image acquisition
software, the developed RAM driver and software seem to use the least RAM. In
addition, there are no examples of Kernel Mode RAM Drivers developed using WDK
in the literature.

.

Makale detayları

Development of Kernel Mode RAM Driver for RAM Image on Windows

Yazarlar: Ahmet Ali SÜZEN | Kubilay TAŞDELEN | Ecir Uğur KÜÇÜKSİLLE

Yayıncı: Süleyman Demirel University

Ana Başlıklar: Uygulamalı fizik

Dergi: Süleyman Demirel University Journal of Natural and Applied Sciences 2019 Vol.23 Issue 2, pp.498-504

Belge Tipi: Makale

Yayın Tarihi: 8/2019

Belge Dili: İngilizce

Document ID (Org No.): 2000553327

Sıklık: Üç Yıllık

eISSN: 1308-6529

DOI: https://doi.org/10.19113/sdufenbed.529039

Sayı

Yazarlar:

Ahmet Ali SÜZEN | Kubilay TAŞDELEN | Ecir Uğur KÜÇÜKSİLLE

Yayıncı:

Süleyman Demirel University

Ana Başlıklar:

Uygulamalı fizik

Dergi:

Süleyman Demirel University Journal of Natural and Applied Sciences 2019 Vol.23 Issue 2, pp.498-504

Belge Tipi:

Makale

Yayın Tarihi:

8/2019

Belge Dili:

İngilizce

Document ID (Org No.):

2000553327

Sıklık:

Üç Yıllık

eISSN:

1308-6529

DOI:

https://doi.org/10.19113/sdufenbed.529039