讯会议法医基于内存反向分析.
Shilong Yu1, Binglong Li1, Lin Zhu1
1School of Cryptographic Engineering, Information Engineering University, Zhengzhou, China.
PeerJ. Computer science
|June 26, 2025
概括
本研究介绍了讯会议的新型记忆法医方法,使得能够提取关键会议数据,如参与者列表和文件. 这种数字取证技术为传统磁盘分析不足的调查提供了重要的证据.
科学领域:
- 数字法医学数字法医学
- 计算机科学 计算机科学
背景情况:
- 讯会议是一个广泛使用的即时会议软件.
- 传统的磁盘取证方法对于讯会议是无效的,因为它的实时数据处理.
- 记忆分析对于讯会议的法医分析是必要的.
研究的目的:
- 提出一种基于记忆反向分析的讯会议取证方法.
- 为了提取在讯会议期间传输的会议数据.
- 为数字犯罪调查提供关键的数字证据.
主要方法:
- 通过分析讯会议的内存过程存储和元数据格式,设计了一个反向元数据提取算法.
- 通过分析讯会议的内存数据结构,开发了一个会议数据流雕刻算法.
- 在整个内存文件上进行了内存反向分析.
主要成果:
- 有效地提取元数据,包括会议时间,号码和主题.
- 提取数据流信息,如参与者,消息记录和传输的文件.
- 与其他方法相比,证明了更全面的法医数据提取.
结论:
- 提议的内存反向分析方法对讯会议法医有效.
- 这种方法为数字犯罪调查提供了关键的数字证据.
- 这种方法允许从内存中提取更全面和丰富的法医数据.
相关概念视频
Understanding Memory
646
Memory is the retention of information or experiences over time, facilitated through three main processes: encoding, storage, and retrieval. Encoding is the process of inputting information into the memory system. For instance, when listening to a lecture, watching a play, reading a book, or having a conversation, the brain is actively encoding information. This initial stage involves transforming sensory input into a form that can be processed and stored by the brain. Various factors, such as...
646
False Memories
149
False memories represent a cognitive distortion in which individuals recall events that did not happen, or remember them in an altered form. This phenomenon highlights the brain's constructive nature in processing and recalling memories, emphasizing that memory is not a perfect representation of past events but rather a dynamic reconstruction influenced by various factors.
One primary source of false memories is misattribution, where individuals incorrectly associate external information...
One primary source of false memories is misattribution, where individuals incorrectly associate external information...
149
Eyewitness Memory
178
Eyewitness memory refers to the recollection of events by someone who has directly witnessed them, often serving as critical evidence in legal settings. This type of memory is commonly used in criminal cases where a witness describes details like a suspect's appearance, clothing, or behavior during a crime. However, despite its perceived reliability, eyewitness memory is prone to significant errors.
One such error is memory distortion, which occurs because human memory does not function...
One such error is memory distortion, which occurs because human memory does not function...
178
Interference and Decay
215
Forgetting is a complex cognitive phenomenon influenced by several factors, among which interference and decay are particularly prominent. These processes explain why individuals often struggle to retrieve specific information from memory, leading to lapses in recall that can be observed in everyday situations.
Interference occurs when competing memories hinder the retrieval of particular information. It can be classified into two types: proactive and retroactive interference. Proactive...
Interference occurs when competing memories hinder the retrieval of particular information. It can be classified into two types: proactive and retroactive interference. Proactive...
215
Tip-of-the-Tongue Phenomenon
244
The tip-of-the-tongue (TOT) phenomenon is a cognitive experience characterized by a temporary inability to retrieve specific information from memory despite having a strong feeling of knowing the information. Although individuals cannot access the target word or detail, they frequently recall related elements, such as its initial letter, syllable count, or context. This partial retrieval often causes frustration, as one might recognize a familiar face or know that a name starts with a specific...
244
Retrieval
179
Retrieval is the process of getting information out of memory storage and back into conscious awareness. This ability is essential for daily tasks like brushing hair and teeth, driving to work, and performing job duties. Retrieval occurs in three ways: recall, recognition, and relearning.
Recall involves accessing information without cues, such as during an essay test, where individuals must retrieve facts and concepts from memory unaided. Another example is remembering the name of a colleague...
Recall involves accessing information without cues, such as during an essay test, where individuals must retrieve facts and concepts from memory unaided. Another example is remembering the name of a colleague...
179


