Forensisk analys av volatilt minne från operativsystemet OS X

Behovet av att analysera volatilt minne från Macintosh-datorer med OS X har blivit allt mer betydelsefull på grund av att deras datorer blivit allt populärare och att volatil minnesanalysering blivit en allt viktigare del i en IT-forensikers arbete. Anledningen till att volatil minnesanalysering blivit allt viktigare är för att det går att finna viktig information som inte finns lagrad permanent på datorns interna hårddisk. Problemet som låg till grunden för det här examensarbetet var att det uppenbart fanns brist på undersökningsmetoder av det volatila minnet för Mac-datorer med OS X.Syftet med detta arbete var därför att undersöka möjligheten att utvinna information från ett volatilt minne från en Mac-dator med OS X genom att kartlägga och bedöma olika undersökningsmetoder. För att göra denna undersökning har litteraturstudier, informella intervjuer, egna kunskaper och praktiska försök genomförts.Slutsatsen blev att möjligheten att utvinna information från det volatila minnet från en Mac-dator med OS X är relativt begränsad. Det största problemet är själva dumpningen av minnet. Många av dumpningsmetoderna som finns att tillgå kräver administrativa rättigheter. Vid analysering av en minnesdump bör man aldrig förlita sig på en analysmetod då olika analysmetoder ger olika resultat som kan vara till nytta för en vidare undersökning av en Mac-dator.

A Complexity Based Model for Quantifying Forensic Evidential Probabilities

An operational complexity model (OCM) is proposed to enable the complexity of both the cognitive and the computational components of a process to be determined. From the complexity of formation of a set of traces via a specified route a measure of the probability of that route can be determined. By determining the complexities of alternative routes leading to the formation of the same set of traces, the odds ratio indicating the relative plausibility of the alternative routes can be found. An illustrative application to a BitTorrent piracy case is presented, and the results obtained suggest that the OCM is capable of providing a realistic estimate of the odds ratio for two competing hypotheses. It is also demonstrated that the OCM can be straightforwardly refined to encompass a variety of circumstances.

Evaluation of the Conservation Lands of Maine Based on Presence of Habitat Suitable for Listed Species

“Conservation Lands” include both public and private lands that are devoted to the protection of wildlife and natural resources. “Listed Species” include federally and state endangered and threatened animals that are in danger of extermination in the state of Maine. The purpose of this study is to determine how well conservation lands are protecting the habitats of listed species. GAP data was used for 13 terrestrial vertebrate species indicating the presence or absence of suitable habitats. This data was compiled in GIS, generating a layer showing the number of listed species an area is suitable for. The areas that were suitable for at least one habitat were compared to answer three questions: (1) Is there is a difference between the presence and absence of listed species on protected lands and lands that are not protected? (2) Is there is a difference between the presence and absence of listed species on public lands managed by the state and the federal government and private land? (3) Is there is a difference between the presence and absence of listed species on lands protected under easements and lands that are protected fee simple? We found significant differences between all three categories. Conservation lands, private lands, and lands held under easement protect the habitat of listed species most effectively. We believe that this is due to the large number of private land trusts in the state of Maine and the effective management strategies of state lands.