Blurriness in Live Forensics: An Introduction.

The Live Forensics discipline aims at answering basic questions related
to a digital crime, which usually involves a computer-based system. The investigation
should be carried out with the very goal to establish which processes
were running, when they were started and by whom, what specific activities those
processes were doing and the state of active network connections. Besides, a set
of tools needs to be launched on the running system by altering, as a consequence
of the Locard’s exchange principle [2], the system’s memory. All the methodologies
for the live forensics field proposed until now have a basic, albeit important,
weakness, which is the inability to quantify the perturbation, or blurriness, of the
system’s memory of the investigated computer. This is the very last goal of this
paper: to provide a set of guidelines which can be effectively used for measuring
the uncertainty of the collected volatile memory on a live system being investigated.