{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,8]],"date-time":"2025-03-08T12:40:02Z","timestamp":1741437602460,"version":"3.38.0"},"publisher-location":"Berlin, Heidelberg","reference-count":23,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"type":"print","value":"9783642226021"},{"type":"electronic","value":"9783642226038"}],"license":[{"start":{"date-parts":[[2011,1,1]],"date-time":"2011-01-01T00:00:00Z","timestamp":1293840000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2011]]},"DOI":"10.1007\/978-3-642-22603-8_40","type":"book-chapter","created":{"date-parts":[[2011,8,9]],"date-time":"2011-08-09T12:35:07Z","timestamp":1312893307000},"page":"449-465","source":"Crossref","is-referenced-by-count":2,"title":["Extraction of User Information by Pattern Matching Techniques in Windows Physical Memory"],"prefix":"10.1007","author":[{"given":"Funminiyi","family":"Olajide","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nick","family":"Savage","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"issue":"001","key":"40_CR1","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1016\/j.diin.2006.10.001","volume":"III","author":"N.L. Petroni Jr.","year":"2006","unstructured":"Petroni Jr., N.L., Walters, A., Fraser, T., Arbaugh, W.A.: FATKit: A framwork for the extraction and analysis of digital forenisc from volatile sysytem memory. Journal of Digital Investigation\u00a0III(001), 197\u2013210 (2006)","journal-title":"Journal of Digital Investigation"},{"key":"40_CR2","unstructured":"Farmer, D., Venema, W.: The coroner\u2019s toolkit, TCT (August 2004), http:\/\/www.porcupine.org\/forensics\/tct.html"},{"issue":"01","key":"40_CR3","first-page":"10","volume":"I","author":"B.D. Carrier","year":"2004","unstructured":"Carrier, B.D., Grand, J.: A hardware-based memory acquisition procedure for digital investigations. International Journal of Digital Evidence (IJDE)\u00a0I(01), 10\u201323 (2004)","journal-title":"International Journal of Digital Evidence (IJDE)"},{"key":"40_CR4","volume-title":"Forensic discovery","author":"D. Farmer","year":"2005","unstructured":"Farmer, D., Venema, W.: Forensic discovery, 1st edn. Addison-Wesley, Indianapolis (2005)","edition":"1"},{"key":"40_CR5","unstructured":"Carrier, B.D., Spafford, E.H.: Automated digital evidence target definition using outlier analysis and existing evidence. In: Digital Forensic Research Workshop (DFRWS), New Orleans, LA, pp. 62\u201372 (2005)"},{"issue":"6","key":"40_CR6","first-page":"43","volume":"30","author":"S. Stover","year":"2005","unstructured":"Stover, S., Dickerson, M.: Using memory dump in digital forensic; login. The USENIX Magazine\u00a030(6), 43\u201348 (2005)","journal-title":"The USENIX Magazine"},{"issue":"2","key":"40_CR7","first-page":"70","volume":"II","author":"O. Funminiyi","year":"2009","unstructured":"Funminiyi, O., Nick, S.: Application level evidence from volatile memory. Journal of Computing in Systems and Engineering\u00a0II(2), 70\u201378 (2009)","journal-title":"Journal of Computing in Systems and Engineering"},{"issue":"008","key":"40_CR8","doi-asserted-by":"publisher","first-page":"65","DOI":"10.1016\/j.diin.2008.05.008","volume":"V","author":"A. Case","year":"2008","unstructured":"Case, A., Cristina, A., Marziale, L., Richard, G.G., Roussev, V.: FACE: Automated digital evidence discovery and correlation. Journal of Digital Investigation\u00a0V(008), 65\u201375 (2008)","journal-title":"Journal of Digital Investigation"},{"key":"40_CR9","unstructured":"Digital Forensic Research Workshop (DFRWS) (July 2007), http:\/\/www.dfrws.org\/2007\/challenge\/index.shtml"},{"key":"40_CR10","doi-asserted-by":"crossref","unstructured":"Funminiyi, O., Nick, S.: On the extraction of forensically relevant information from physical memory. In: World Congress on Internet Security (WORLDCIS 2011), Technically Co-sponsored by IEEE UK\/RI Computer Chapter, London, pp. 248\u2013252 (2011)","DOI":"10.1109\/WorldCIS17046.2011.5749861"},{"key":"40_CR11","unstructured":"Funminiyi, O., Nick, S.: On the identification of information extracted from Windows physical memory. International Journal for Information Security Research (IJISR)\u00a0II(2) (March 2011) ISSN 2042-4639"},{"issue":"2","key":"40_CR12","first-page":"45","volume":"5","author":"B. Mariusz","year":"2007","unstructured":"Mariusz, B.: Windows memory forensic toolkit; finding digital evidence in physical memory. Journal of Information and Computing Systems\u00a05(2), 45\u201375 (2007)","journal-title":"Journal of Information and Computing Systems"},{"key":"40_CR13","unstructured":"Limon, G.G.: Forensic physical memory analysis: an overview of tools and techniques. In: TKK T-110.5290 Seminar on Network Security, Helsinki, Finland, pp. 305\u2013320 (2007)"},{"key":"40_CR14","unstructured":"Msuiche, Msuiche.net at: Capture memory under win2k3 or vista with win32dd (2008), http:\/\/www.msuiche.net\/2008\/06\/14\/capture-memory-under-win2k3-orvista-with-win32dd (accessed March)"},{"key":"40_CR15","unstructured":"Memory, M.: ManTech international corporation. memory dd, http:\/\/www.mantech.com\/msma\/MDD.asp (accessed March 2010)"},{"key":"40_CR16","volume-title":"Microsoft Windows internal covering Windows server 2008 and Windows vista","author":"M.E. Russinovich","year":"2009","unstructured":"Russinovich, M.E., Solomon, D.A.: Microsoft Windows internal covering Windows server 2008 and Windows vista, 5th edn. Microsoft Press, Washington (2009)","edition":"5"},{"key":"40_CR17","unstructured":"Agile Risk Management.Nigilat32 small footprint, Agile, http:\/\/www.agilerm.net\/nigilant32 (accessed October 2009)"},{"key":"40_CR18","unstructured":"Chris, B.: Mempaser analysis tool, memory forensics analysis tool for microsoft Windows systems. In: DFRWS 2005 Forensic Challenge Can be Accessed, MA, pp. 100\u2013115 (2005), http:\/\/www.dfrws.org\/2005\/challenge\/memparser.shtml"},{"key":"40_CR19","unstructured":"Volatile Systems. The volatility framework: volatlile memory artifact extraction utility framework (April 2009), Can be accessed at, http:\/\/www.volatilesystems.com\/default\/volatility"},{"key":"40_CR20","unstructured":"Harlan, C., Dave, K.: Windows forensic analysis incident response and cybercrime investigation secrets, 1st edn., vol.\u00a0III(3), pp. 43\u201367. Syngress Publishing (July 2007)"},{"key":"40_CR21","unstructured":"Funminiyi, O., Nick, S.: Forensic live response and events reconstruction methods in linux systems. In: PGNET - The Convergence of Telecommunications Networking and Broadcasting, Liverpool, UK, pp. 141\u2013147 (December 2009)"},{"key":"40_CR22","unstructured":"Funminiyi, O., Nick, S.: Dispersal of time aspect of information stored on physical memory. In: Cyberforensic - International Conference on Cybercrime Security and Digital Forensics, Glasgow, UK (2011)"},{"key":"40_CR23","unstructured":"Funminiyi, O., Nick, S.: Digital forensic research and method of extracting relevant information from physical memory of Windows XP. In: Fourth International Conference on Internet Technologies and Applications (ITA11), Wrexam, Wales, UK (2011)"}],"container-title":["Communications in Computer and Information Science","Digital Enterprise and Information Systems"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-22603-8_40","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,8]],"date-time":"2025-03-08T12:03:08Z","timestamp":1741435388000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-22603-8_40"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011]]},"ISBN":["9783642226021","9783642226038"],"references-count":23,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-22603-8_40","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"type":"print","value":"1865-0929"},{"type":"electronic","value":"1865-0937"}],"subject":[],"published":{"date-parts":[[2011]]}}}