内存取证工具的研究与实现

发布时间：2018-05-12 03:35

本文选题：计算机取证 + 在线取证　；参考：《上海交通大学》2013年硕士论文

【摘要】：随着信息技术的飞速发展，计算机和互联网逐渐成为了社会生活各个领域的重要组成部分。一方面它们的出现极大地便利了人们的生活和工作，另一方面，它们也越来越多地被不法分子用于从事非法活动。而计算机取证技术作为打击计算机犯罪的重要手段之一，应该做到与时俱进，以充分发挥打击犯罪的作用。计算机在线取证是计算机司法取证的一个重要组成部分，在很多方面都有着不可替代的地位,而计算机内存取证作为在线取证的最重要环节，也是当今的电子取证研究的热点之一。本文从物理内存和虚拟内存两个方面，研究并提出了计算机内存取证活动中系统内存的信息获取技术和方法，开发出了两个实用、有效的内存取证工具。本文研究工作包括以下两个方面： 1）研究提出了基于进程冻结的物理内存取证方法，开发了相应的工具。很多现有的物理内存获取的研究都是基于通过在用户态下直接打开内核对象来访问并获取物理内存，然而在新版本的Windows操作系统都无法直接访问内核对象。而且现有的工具多数并不是专门为取证活动而开发，因而在一定程度上使用获取到的内核镜像文件缺乏证据力。本文在分析Windows内核驱动程序访问物理内存的基本原理的基础上，综合考虑计算机取证活动的特殊需求，提出了基于进程冻结的物理内存取证方法，并开发了PhyMmDumper工具。与win32dd和DumpIt工具的比对实验表明，，该工具在性能上具有一定的优势。 2）研究提出了基于卷影复制服务的虚拟内存取证方法，开发了相应的工具。现有的取证工具中都只关注系统物理内存的获取和分析，而忽略了页交换文件的重要作用。本文分析了Windows操作系统内存管理机制以及现有的获取页交换文件的原理和流程，研究并提出了一种新的基于卷影复制服务的虚拟内存取证方法。这种方法最大的特点在于服务本身是由微软提供的，在可信度上比其它工具所采用的基于强制复制的方法要高很多，而且在原理上也符合取证活动中的要求。在此基础上开发了PagefileCopy工具。实验表明，工具能够在开机的状态下快速地获取系统交换文件。目前，上述两个内存取证工具已在公安部第三研究所开始试用，获得了良好的用户反馈。
[Abstract]:With the rapid development of information technology, computers and the Internet have gradually become an important part of all fields of social life. On the one hand, their appearance greatly facilitates people's life and work, on the other hand, they are increasingly used by illegal elements to engage in illegal activities. As one of the important means to crack down on computer crime, computer forensics should keep pace with the times so as to give full play to the role of cracking down on crime. Computer online forensics is an important part of computer judicial forensics. It has an irreplaceable position in many aspects, and computer memory forensics is the most important link in online forensics. It is also one of the hotspots of electronic forensics research. From two aspects of physical memory and virtual memory, this paper studies and puts forward the information acquisition technology and method of system memory in computer memory forensics, and develops two practical and effective memory forensics tools. The research work of this paper includes the following two aspects: 1) the physical memory forensics method based on process freezing is proposed, and the corresponding tools are developed. Many existing researches on physical memory acquisition are based on accessing and acquiring physical memory by directly opening kernel objects in user state. However, in the new version of Windows operating system, kernel objects can not be accessed directly. Moreover, most of the existing tools are not specially developed for the purpose of obtaining evidence, so there is a lack of evidence to use the obtained kernel image files to some extent. On the basis of analyzing the basic principle of accessing physical memory by Windows kernel driver and considering the special requirement of computer forensics, this paper puts forward a method of physical memory forensics based on process freezing, and develops a PhyMmDumper tool. The comparison with win32dd and DumpIt tools shows that the tool has some advantages in performance. 2) the virtual memory forensics method based on volume shadow copy service is proposed and the corresponding tools are developed. The existing forensics tools only focus on the acquisition and analysis of system physical memory, while ignoring the important role of page exchange files. This paper analyzes the memory management mechanism of Windows operating system and the principle and flow of obtaining page exchange files, and proposes a new virtual memory forensics method based on volume shadow replication service. The biggest feature of this approach is that the service itself is provided by Microsoft, which is much more reliable than the mandatory replication-based approach used by other tools, and in principle conforms to the requirements of forensics. On this basis, the PagefileCopy tool is developed. Experiments show that the tool can quickly obtain the system exchange files in the state of boot. At present, the above two memory forensics tools have been tested in the third Institute of the Ministry of Public Security, and good user feedback has been obtained.
【学位授予单位】：上海交通大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：TP393.08;D918.2

【相似文献】