{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T16:23:07Z","timestamp":1781108587625,"version":"3.54.1"},"reference-count":20,"publisher":"IGI Global Scientific Publishing","issue":"4","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,10,1]]},"abstract":"<p>Live digital forensics presents unique challenges with respect to maintaining forensic soundness, but also offers the ability to examine information that is unavailable to quiescent analysis. Any perturbation of a live operating system by a forensic examiner will have far-reaching effects on the state of the system being analysed. Numerous approaches to live digital forensic evidence acquisition have been proposed in the literature, but relatively little attention has been paid to the problem of identifying how the effects of these approaches, and their improvements over other techniques, can be evaluated and quantified. In this paper, the authors present Pypette, a novel platform enabling the automated, repeatable analysis of live digital forensic acquisition techniques.<\/p>","DOI":"10.4018\/jdcf.2012100103","type":"journal-article","created":{"date-parts":[[2013,2,6]],"date-time":"2013-02-06T11:28:22Z","timestamp":1360150102000},"page":"31-46","source":"Crossref","is-referenced-by-count":2,"title":["Pypette"],"prefix":"10.4018","volume":"4","author":[{"given":"Brett","family":"Lempereur","sequence":"first","affiliation":[{"name":"School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Madjid","family":"Merabti","sequence":"additional","affiliation":[{"name":"School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qi","family":"Shi","sequence":"additional","affiliation":[{"name":"School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"jdcf.2012100103-0","doi-asserted-by":"publisher","DOI":"10.1145\/1113034.1113070"},{"key":"jdcf.2012100103-1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04155-6_2"},{"key":"jdcf.2012100103-2","doi-asserted-by":"publisher","DOI":"10.1145\/1113034.1113069"},{"key":"jdcf.2012100103-3","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2007.05.001"},{"key":"jdcf.2012100103-4","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2008.05.010"},{"key":"jdcf.2012100103-5","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-72367-9_1"},{"key":"jdcf.2012100103-6","doi-asserted-by":"crossref","unstructured":"Hargreaves, C., & Chivers, H. (2008). Recovery of encryption keys from memory using a linear scan. In Proceedings of the Third International Conference on Availability, Reliability and Security (pp. 1369-1376).","DOI":"10.1109\/ARES.2008.109"},{"key":"jdcf.2012100103-7","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2009.43"},{"key":"jdcf.2012100103-8","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.05.006"},{"key":"jdcf.2012100103-9","first-page":"1","article-title":"What is forensic computing?","volume":"118","author":"R.McKemmish","year":"1999","journal-title":"Trends and Issues in Crime and Criminal Justice"},{"key":"jdcf.2012100103-10","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-84927-0_1"},{"key":"jdcf.2012100103-11","doi-asserted-by":"crossref","unstructured":"Mohay, G. (2005). Technical challenges and directions for digital forensics. In Proceedings of the First International Workshop on Systematic Approaches to Digital Forensic Engineering (pp. 155-161).","DOI":"10.1109\/SADFE.2005.24"},{"key":"jdcf.2012100103-12","doi-asserted-by":"publisher","DOI":"10.1145\/1113034.1113074"},{"key":"jdcf.2012100103-13","unstructured":"Rutkowska, J. (2007). Beyond the CPU: Defeating hardware based RAM acquisition. In Proceedings of BlackHat DC."},{"key":"jdcf.2012100103-14","unstructured":"Safe. (2007). Good practice guide for computer-based electronic evidence (pp. 1-72). London, UK: Association of Chief Police Officers."},{"key":"jdcf.2012100103-15","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2007.06.009"},{"key":"jdcf.2012100103-16","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368516"},{"key":"jdcf.2012100103-17","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2012.04.005"},{"key":"jdcf.2012100103-18","unstructured":"Walters, A., & Petroni, N. L. (2007). Volatools: Integrating volatile memory forensics into the digital investigation process. In Proceedings of Black Hat DC."},{"key":"jdcf.2012100103-19","doi-asserted-by":"crossref","unstructured":"Wang, L., Zhang, R., & Zhang, S. (2009). A model of computer live forensics based on physical memory analysis. In Proceedings of the1st International Conference on Information Science and Engineering (pp. 4647-4649).","DOI":"10.1109\/ICISE.2009.69"}],"container-title":["International Journal of Digital Crime and Forensics"],"original-title":[],"language":"ng","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=74804","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T15:47:47Z","timestamp":1654098467000},"score":1,"resource":{"primary":{"URL":"https:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/jdcf.2012100103"}},"subtitle":["A Platform for the Evaluation of Live Digital Forensics"],"short-title":[],"issued":{"date-parts":[[2012,10,1]]},"references-count":20,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2012,10]]}},"URL":"https:\/\/doi.org\/10.4018\/jdcf.2012100103","relation":{},"ISSN":["1941-6210","1941-6229"],"issn-type":[{"value":"1941-6210","type":"print"},{"value":"1941-6229","type":"electronic"}],"subject":[],"published":{"date-parts":[[2012,10,1]]}}}