CAT Record (Computer Activity Timeline Record): A Unified Agent Based Approach for Real Time Computer Forensic Evidence Collection
Author URLs
Document Type
Conference Proceeding
Publication Date
2013
Subject: LCSH
Cloud computing, Computer crimes--Investigation, Operating systems (Computers)
Disciplines
Computer Engineering | Computer Sciences | Electrical and Computer Engineering | Forensic Science and Technology | Information Security
Abstract
In this paper we present CAT Record - a real time computer forensics agent that records computer activity for subsequent forensic investigation on a Windows computer system as actions are taking place on a system. This approach is different from the traditional post-mortem approach of examining a hard disk since activities are being recorded as they are happening. The prototype agent included six modules 1) Windows Event Watcher - which records the Windows Operating System events 2) Active Window Detector - which records the active windows on the screen 3) Font-Time-Power-Resolution Detector - which records changes in font, time, power or resolution on the system 4) Explorers Monitor - which records the activity when opening an item from the Windows Explorer or Internet Explorer 5) Removable Devices Detector - which records any external devices that are plugged in or removed from a system and 6) File System Watcher - which records the activity taking place on the file system. CAT Record was stress tested in three scenarios using an automated program that was written to test the accuracy of the agent and its memory consumption on Windows XP and Windows 7. Overall, the results indicated that the amount of recorded data varied between Windows XP and Windows 7 and that CAT Record on average did not consume more than 42,876 KB of memory per second during its operation under extremely stressful tests.
DOI
10.1109/SADFE.2013.6911539
Repository Citation
Al Awawdeh, Shadi; Baggili, Ibrahim; Marrington, Andrew; and Iqbal, Farkhund, "CAT Record (Computer Activity Timeline Record): A Unified Agent Based Approach for Real Time Computer Forensic Evidence Collection" (2013). Electrical & Computer Engineering and Computer Science Faculty Publications. 44.
https://digitalcommons.newhaven.edu/electricalcomputerengineering-facpubs/44
Publisher Citation
Al Awawdeh, S., Baggili, I., Marrington, A., & Iqbal, F. (2013, November). CAT Record (computer activity timeline record): A unified agent based approach for real time computer forensic evidence collection. In Systematic Approaches to Digital Forensic Engineering (SADFE), 2013 Eighth International Workshop on (pp. 1-8). Piscataway, N.J.: IEEE. ISBN: 9781479940608
Comments
Purchase this proceeding here.
Purchase complete conference proceedings here.
Dr. Baggili was appointed to the University of New Haven's Elder Family Endowed Chair in 2015.