{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:26:50Z","timestamp":1750307210647,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":17,"publisher":"ACM","license":[{"start":{"date-parts":[[2011,7,11]],"date-time":"2011-07-11T00:00:00Z","timestamp":1310342400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["6.09E+31"],"award-info":[{"award-number":["6.09E+31"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key Program for Basic Research of Shanghai","award":["095107016001051150010210DZ1500200"],"award-info":[{"award-number":["095107016001051150010210DZ1500200"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2011,7,11]]},"DOI":"10.1145\/2103799.2103815","type":"proceedings-article","created":{"date-parts":[[2012,1,24]],"date-time":"2012-01-24T16:47:19Z","timestamp":1327423639000},"page":"1-5","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Vis"],"prefix":"10.1145","author":[{"given":"Miao","family":"Yu","sequence":"first","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qian","family":"Lin","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bingyu","family":"Li","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhengwei","family":"Qi","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haibing","family":"Guan","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2011,7,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Intel 64 and IA-32 Architectures Software Developer's Manuals. Intel Corporation 2007. Intel 64 and IA-32 Architectures Software Developer's Manuals . Intel Corporation 2007."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1113034.1113070"},{"key":"e_1_3_2_1_3_1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"131","DOI":"10.1007\/978-3-540-76788-6_11","volume-title":"ICISC","author":"Ando R.","year":"2007","unstructured":"Ando , R. , Kadobayashi , Y. , and Shinoda , Y . Asynchronous pseudo physical memory snapshot and forensics on paravirtualized vmm using split kernel module . In ICISC ( 2007 ), K.-H. Nam and G. Rhee, Eds ., vol. 4817 of Lecture Notes in Computer Science , Springer , pp. 131 -- 143 . Ando, R., Kadobayashi, Y., and Shinoda, Y. Asynchronous pseudo physical memory snapshot and forensics on paravirtualized vmm using split kernel module. In ICISC (2007), K.-H. Nam and G. Rhee, Eds., vol. 4817 of Lecture Notes in Computer Science, Springer, pp. 131--143."},{"key":"e_1_3_2_1_5_1","volume-title":"File System Forensic Analysis","author":"Carrier B.","year":"2005","unstructured":"Carrier , B. File System Forensic Analysis . Addison-Wesley Professional , 2005 . Carrier, B. File System Forensic Analysis. Addison-Wesley Professional, 2005."},{"key":"e_1_3_2_1_6_1","article-title":"Evidence dynamics: Locard's exchange principle & crime reconstruction","volume":"1","author":"Chisum W. J.","year":"2000","unstructured":"Chisum , W. J. , and Turvey , B. E . Evidence dynamics: Locard's exchange principle & crime reconstruction . Journal of Behavioral Profiling 1 (Janurary 2000 ). Chisum, W. J., and Turvey, B. E. Evidence dynamics: Locard's exchange principle & crime reconstruction. Journal of Behavioral Profiling 1 (Janurary 2000).","journal-title":"Journal of Behavioral Profiling"},{"key":"e_1_3_2_1_7_1","volume-title":"NDSS","author":"Garfinkel T.","year":"2003","unstructured":"Garfinkel , T. , and Rosenblum , M . A virtual machine introspection based architecture for intrusion detection . In NDSS ( 2003 ), The Internet Society . Garfinkel, T., and Rosenblum, M. A virtual machine introspection based architecture for intrusion detection. In NDSS (2003), The Internet Society."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2009.43"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368517"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866314"},{"key":"e_1_3_2_1_11_1","unstructured":"MANDIANT Corporation. Memoryze. http:\/\/www.mandiant.com\/products\/free_software\/memoryze\/.  MANDIANT Corporation. Memoryze. http:\/\/www.mandiant.com\/products\/free_software\/memoryze\/."},{"key":"e_1_3_2_1_12_1","first-page":"297","volume-title":"Proceedings of the 13th international conference on Recent advances in intrusion detection (Berlin, Heidelberg, 2010), RAID'10, Springer-Verlag","author":"Martignoni L.","unstructured":"Martignoni , L. , Fattori , A. , Paleari , R. , and Cavallaro , L . Live and trustworthy forensic analysis of commodity production systems . In Proceedings of the 13th international conference on Recent advances in intrusion detection (Berlin, Heidelberg, 2010), RAID'10, Springer-Verlag , pp. 297 -- 316 . Martignoni, L., Fattori, A., Paleari, R., and Cavallaro, L. Live and trustworthy forensic analysis of commodity production systems. In Proceedings of the 13th international conference on Recent advances in intrusion detection (Berlin, Heidelberg, 2010), RAID'10, Springer-Verlag, pp. 297--316."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.17"},{"key":"e_1_3_2_1_14_1","volume-title":"Eds. Proceedings of the 2007 ACM Conference on Computer and Communications Security, CCS 2007","author":"Ning P.","year":"2007","unstructured":"Ning , P. , di Vimercati , S. D. C. , and Syverson , P. F ., Eds. Proceedings of the 2007 ACM Conference on Computer and Communications Security, CCS 2007 , Alexandria, Virginia, USA, October 28--31 , 2007 (2007), ACM. Ning, P., di Vimercati, S. D. C., and Syverson, P. F., Eds. Proceedings of the 2007 ACM Conference on Computer and Communications Security, CCS 2007, Alexandria, Virginia, USA, October 28--31, 2007 (2007), ACM."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.24"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2007.06.009"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368516"},{"key":"e_1_3_2_1_18_1","unstructured":"Wikipedia. Digital forensic process. http:\/\/en.wikipedia.org\/wiki\/Digital_forensic_process.  Wikipedia. Digital forensic process. http:\/\/en.wikipedia.org\/wiki\/Digital_forensic_process."}],"event":{"name":"APSys '11: Asia Pacific Workshop on Systems","sponsor":["USENIX Assoc USENIX Assoc","SIGOPS ACM Special Interest Group on Operating Systems"],"location":"Shanghai China","acronym":"APSys '11"},"container-title":["Proceedings of the Second Asia-Pacific Workshop on Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2103799.2103815","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2103799.2103815","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:06:36Z","timestamp":1750241196000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2103799.2103815"}},"subtitle":["virtualization enhanced live acquisition for native system"],"short-title":[],"issued":{"date-parts":[[2011,7,11]]},"references-count":17,"alternative-id":["10.1145\/2103799.2103815","10.1145\/2103799"],"URL":"https:\/\/doi.org\/10.1145\/2103799.2103815","relation":{},"subject":[],"published":{"date-parts":[[2011,7,11]]},"assertion":[{"value":"2011-07-11","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}