{"id":"https://openalex.org/W70133349","doi":null,"title":"A study of application level information from the volatile memory of Windows computer systems","display_name":"A study of application level information from the volatile memory of Windows computer systems","publication_year":2011,"publication_date":"2011-01-01","ids":{"openalex":"https://openalex.org/W70133349","mag":"70133349"},"language":"en","primary_location":{"id":"pmh:oai:uilis.unsyiah.ac.id:30253","doi":null,"is_oa":false,"landing_page_url":"http://uilis.unsyiah.ac.id/opentheses/items/show/30253","pdf_url":null,"source":{"id":"https://openalex.org/S4377196378","display_name":"UPT. Syiah Kuala University Library (Syiah Kuala University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I187494767","host_organization_name":"Universitas Syiah Kuala","host_organization_lineage":["https://openalex.org/I187494767"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"","raw_type":"Thesis"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040449764","display_name":"Funminiyi Olajide","orcid":"https://orcid.org/0000-0003-1627-6637","observed_orcids":["https://orcid.org/0000-0003-1627-6637"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Funminiyi Olajide","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0003-1627-6637","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5040449764"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/volatile-memory-analysis","display_name":"volatile memory analysis","score":0.8899999856948853},{"id":"https://openalex.org/keywords/windows-software","display_name":"Windows applications","score":0.6539999842643738},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.8849999904632568},{"id":"https://openalex.org/keywords/digital-evidence-admissibility","display_name":"digital evidence admissibility","score":0.6759999990463257},{"id":"https://openalex.org/keywords/microsoft-office-applications","display_name":"Microsoft Office applications","score":0.5609999895095825},{"id":"https://openalex.org/keywords/internet-explorer","display_name":"Internet Explorer","score":0.9190000295639038},{"id":"https://openalex.org/keywords/forensic-data-recovery","display_name":"forensic data recovery","score":0.4189999997615814},{"id":"https://openalex.org/keywords/memory-forensics","display_name":"memory forensics","score":0.5370000004768372},{"id":"https://openalex.org/keywords/windows-7","display_name":"Windows 7","score":0.36899998784065247}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7591265439987183},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.4599124789237976},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.456841379404068},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41071704030036926},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3839561939239502},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"pmh:oai:uilis.unsyiah.ac.id:30253","doi":null,"is_oa":false,"landing_page_url":"http://uilis.unsyiah.ac.id/opentheses/items/show/30253","pdf_url":null,"source":{"id":"https://openalex.org/S4377196378","display_name":"UPT. Syiah Kuala University Library (Syiah Kuala University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I187494767","host_organization_name":"Universitas Syiah Kuala","host_organization_lineage":["https://openalex.org/I187494767"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"","raw_type":"Thesis"},{"id":"pmh:hdl:10068/994599","doi":null,"is_oa":false,"landing_page_url":"http://hdl.handle.net/10068/994599","pdf_url":null,"source":{"id":"https://openalex.org/S4377196900","display_name":"OpenGrey (Institut de l'Information Scientifique et Technique)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I1295345811","host_organization_name":"Institut de l'Information Scientifique et Technique","host_organization_lineage":["https://openalex.org/I1295345811"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"U - Thesis"},{"id":"pmh:oai:westminsterresearch.westminster.ac.uk:w464q","doi":null,"is_oa":false,"landing_page_url":"https://westminsterresearch.westminster.ac.uk/item/w464q/a-study-of-application-level-information-from-the-volatile-memory-of-windows-computer-systems","pdf_url":null,"source":{"id":"https://openalex.org/S4306400277","display_name":"WestminsterResearch (University of Westminster)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I94951947","host_organization_name":"University of Westminster","host_organization_lineage":["https://openalex.org/I94951947"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"phd"},{"id":"mag:70133349","doi":null,"is_oa":false,"landing_page_url":"https://ethos.bl.uk/OrderDetails.do?uin=uk.bl.ethos.555928","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":55,"referenced_works":["https://openalex.org/W9138350","https://openalex.org/W13960567","https://openalex.org/W24678375","https://openalex.org/W42959298","https://openalex.org/W192026353","https://openalex.org/W322610004","https://openalex.org/W1177028454","https://openalex.org/W1494351124","https://openalex.org/W1533580595","https://openalex.org/W1968389182","https://openalex.org/W1970795821","https://openalex.org/W1982531768","https://openalex.org/W1990614609","https://openalex.org/W1992854975","https://openalex.org/W2006172326","https://openalex.org/W2010376606","https://openalex.org/W2012414703","https://openalex.org/W2040527645","https://openalex.org/W2042068695","https://openalex.org/W2048168101","https://openalex.org/W2067550567","https://openalex.org/W2074086595","https://openalex.org/W2081989812","https://openalex.org/W2082222870","https://openalex.org/W2083065619","https://openalex.org/W2096127821","https://openalex.org/W2103295044","https://openalex.org/W2104621044","https://openalex.org/W2106270115","https://openalex.org/W2116503751","https://openalex.org/W2116654667","https://openalex.org/W2117499375","https://openalex.org/W2118534519","https://openalex.org/W2130906372","https://openalex.org/W2132174782","https://openalex.org/W2136135923","https://openalex.org/W2140908857","https://openalex.org/W2142486663","https://openalex.org/W2143642500","https://openalex.org/W2144142225","https://openalex.org/W2156849122","https://openalex.org/W2159280848","https://openalex.org/W2162423596","https://openalex.org/W2163422513","https://openalex.org/W2165722596","https://openalex.org/W2170873916","https://openalex.org/W2289724360","https://openalex.org/W2337826830","https://openalex.org/W2478929913","https://openalex.org/W2516253789","https://openalex.org/W2586708110","https://openalex.org/W2628759714","https://openalex.org/W2730056844","https://openalex.org/W2738747812","https://openalex.org/W3122515275"],"related_works":["https://openalex.org/W2510969328","https://openalex.org/W1535498888","https://openalex.org/W2513915590","https://openalex.org/W1539684307","https://openalex.org/W2485980299","https://openalex.org/W64970136","https://openalex.org/W2104621044","https://openalex.org/W2508066546","https://openalex.org/W2889664417","https://openalex.org/W42959298"],"abstract_inverted_index":{"The":[0,49,124,174,223,238,323,462],"purpose":[1],"of":[2,38,45,51,103,113,128,139,176,210,229,282,318,325,341,379,384,387,403,420,428,431,439,454,469],"this":[3,52,95,122,221,485],"research":[4,53,99,456,467,486],"work":[5],"was":[6,54,180,213,285,302,343,353,392],"to":[7,18,55,66,100,135,151,190,291,414,458,476],"investigate":[8,136],"into":[9],"the":[10,31,58,75,81,104,109,137,143,146,154,159,171,201,207,288,293,326,347,374,377,382,388,399,418,424,440,447,451,455,466,481],"seven":[11],"most":[12],"commonly":[13,186],"used":[14,134,187],"applications":[15,144,172,294,327],"in":[16,121,206,240,287,314,332,373,417,484],"order":[17],"uncover":[19],"information":[20,34,62,107,342,391,406,472],"that":[21,46,132,226,244,261,364,465],"may":[22],"have":[23,163,409,443],"been":[24,164,396,410,444],"hidden":[25],"from":[26,35,92,235,251,355],"forensic":[27,460],"investigators":[28],"by":[29,183],"extracting":[30],"application":[32,60,76,105,389,404,470],"level":[33,61,106,390,405,471],"volatile":[36,47,85,110,385],"memory":[37,86,111,289,386],"a":[39,101,279,315,337],"Windows":[40,93,114],"system":[41],"and":[42,88,108,116,131,166,195,256,260,272,309,358,401,407],"performing":[43],"analysis":[44,87,112,209,378,402],"memory.":[48,333,375],"aim":[50],"formulate":[56],"how":[57],"extracted":[59],"can":[63,232,247,265,367],"be":[64,233,248,266,368,474],"reconstructed":[65],"describe":[67],"what":[68,153,161,167],"user":[69,140,155,177,193,202,211,230,245,263,283,300,319,330,351,365,380],"activities":[70,179],"had":[71],"taken":[72],"place":[73],"on":[74,84,142,158,216,268,423],"under":[77],"investigation.":[78],"After":[79,376],"reviewing":[80],"relevant":[82,90],"literature":[83],"forensically":[89],"data":[91],"applications,":[94],"thesis":[96],"confines":[97],"its":[98],"study":[102],"applications.\\n\\nQuantitative":[115],"qualitative":[117,147],"results":[118],"were":[119,133,149],"produced":[120],"study.":[123],"quantitative":[125],"assessment":[126],"consists":[127],"four":[129,217],"metrics":[130],"quantity":[138],"input":[141,178,194,203,212,231,246,264,284,301,320,331,352,366],"while":[145,446],"measures":[148],"formulated":[150,483],"infer":[152],"is":[156,204],"doing":[157,165],"application,":[160],"they":[162,168],"are":[169],"using":[170,184,480],"for.":[173],"reconstruction":[175],"carried":[181],"out":[182,438],"some":[185,350,371],"English":[188],"words":[189],"search":[191],"for":[192,199,220,345,370,398],"pattern":[196],"matching":[197],"techniques":[198],"when":[200],"known":[205],"investigation.\\n\\nThe":[208],"discussed":[214,411],"based":[215,422],"scenarios":[218,482],"developed":[219],"research.":[222],"result":[224,239],"shows":[225,363],"different":[227],"amounts":[228],"recovered":[234,249,286],"various":[236],"applications.":[237,348],"scenario":[241,277,335],"1,":[242],"indicates":[243],"easily":[250],"Word,":[252],"PowerPoint,":[253],"Outlook":[254,307,356],"Email":[255,308,357],"Internet":[257,310,359],"Explorer":[258,311,360],"7.0":[259,312,361],"little":[262,299,329],"found":[267,344,354],"Excel,":[269],"MS":[270,296],"Access":[271,297],"Adobe":[273],"Reader":[274],"8.0.":[275],"In":[276,304,334],"2,":[278],"significant":[280],"amount":[281,317,340],"allocated":[290],"all":[292,346],"except":[295],"where":[298],"found.":[303],"scenario3,":[305],"only":[306],"resulted":[313],"large":[316],"being":[321],"recovered.":[322],"rest":[324],"retain":[328],"4,":[336],"greatly":[338],"reduced":[339],"But":[349],"which":[362],"retained":[369],"time":[372],"input,":[381],"importance":[383],"discussed.\\n\\nA":[393],"procedure":[394],"has":[395],"formulised":[397],"extraction":[400],"these":[408],"with":[412],"respect":[413],"their":[415],"use":[416],"court":[419],"law":[421],"five":[425],"Daubert":[426,441],"tests":[427,442],"scientific":[429],"method":[430],"gathering":[432],"digital":[433,459],"evidence.":[434],"As":[435],"presented,":[436],"three":[437],"completed":[445],"two":[448],"others":[449],"forms":[450],"unique":[452],"contribution":[453],"project":[457],"community.":[461],"author":[463],"recommends":[464],"theory":[468],"should":[473],"extended":[475],"other":[477],"operating":[478],"systems":[479],"project.":[487]},"counts_by_year":[{"year":2014,"cited_by_count":2},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":2}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2016-06-24T00:00:00"}