{"id":"https://openalex.org/W1982531768","doi":"https://doi.org/10.1016/j.diin.2008.05.007","title":"The impact of Microsoft Windows pool allocation strategies on memory forensics","display_name":"The impact of Microsoft Windows pool allocation strategies on memory forensics","publication_year":2008,"publication_date":"2008-05-27","ids":{"openalex":"https://openalex.org/W1982531768","doi":"https://doi.org/10.1016/j.diin.2008.05.007","mag":"1982531768"},"language":"en","primary_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2008.05.007","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.diin.2008.05.007","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5067454034","display_name":"Andreas Schuster","orcid":"https://orcid.org/0000-0003-1508-1125"},"institutions":[{"id":"https://openalex.org/I4210093367","display_name":"Deutsche Telekom (Germany)","ror":"https://ror.org/00m8prc86","country_code":"DE","type":"company","lineage":["https://openalex.org/I4210093367"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Andreas Schuster","raw_affiliation_strings":["Deutsche Telekom AG, Friedrich-Ebert-Allee 140, D-53113 Bonn, Germany"],"affiliations":[{"raw_affiliation_string":"Deutsche Telekom AG, Friedrich-Ebert-Allee 140, D-53113 Bonn, Germany","institution_ids":["https://openalex.org/I4210093367"]}]}],"institution_assertions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5067454034"],"corresponding_institution_ids":["https://openalex.org/I4210093367"],"apc_list":null,"apc_paid":null,"fwci":11.484,"has_fulltext":true,"fulltext_origin":"ngrams","cited_by_count":57,"citation_normalized_percentile":{"value":0.989434,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":95},"biblio":{"volume":"5","issue":null,"first_page":"S58","last_page":"S64"},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9996,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9996,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.9765,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/memory-protection","display_name":"Memory Protection","score":0.42146438}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.87619925},{"id":"https://openalex.org/C68387754","wikidata":"https://www.wikidata.org/wiki/Q7271585","display_name":"Schedule","level":2,"score":0.63646233},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.55927384},{"id":"https://openalex.org/C508378895","wikidata":"https://www.wikidata.org/wiki/Q1406","display_name":"Microsoft Windows","level":3,"score":0.5170239},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.48656192},{"id":"https://openalex.org/C18131444","wikidata":"https://www.wikidata.org/wiki/Q163585","display_name":"Memory protection","level":5,"score":0.42146438},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.41148427},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.3725478},{"id":"https://openalex.org/C76399640","wikidata":"https://www.wikidata.org/wiki/Q189401","display_name":"Virtual memory","level":4,"score":0.27255386},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.19211257},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.09257004},{"id":"https://openalex.org/C98986596","wikidata":"https://www.wikidata.org/wiki/Q1143031","display_name":"Semiconductor memory","level":2,"score":0.07659447}],"mesh":[],"locations_count":1,"locations":[{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2008.05.007","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true}],"best_oa_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.diin.2008.05.007","pdf_url":null,"source":{"id":"https://openalex.org/S67081940","display_name":"Digital Investigation","issn_l":"1742-2876","issn":["1742-2876","1873-202X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true},"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.67}],"grants":[],"datasets":[],"versions":[],"referenced_works_count":5,"referenced_works":["https://openalex.org/W1736607886","https://openalex.org/W2040527645","https://openalex.org/W2083065619","https://openalex.org/W2337826830","https://openalex.org/W90265526"],"related_works":["https://openalex.org/W618686436","https://openalex.org/W4256444941","https://openalex.org/W4239882962","https://openalex.org/W4239548142","https://openalex.org/W2937484179","https://openalex.org/W2774100693","https://openalex.org/W25917909","https://openalex.org/W2504308523","https://openalex.org/W2282620829","https://openalex.org/W2196547135"],"abstract_inverted_index":{"An":[0],"image":[1],"of":[2,15,20,28,43,94,112,163,173,176,191,203],"a":[3,9,13,102,109,146,153,164,189],"computer's":[4],"physical":[5,113],"memory":[6,70,114,155],"can":[7,46],"provide":[8],"forensic":[10,198,204],"examiner":[11],"with":[12,188],"wealth":[14],"information.":[16],"A":[17],"small":[18],"area":[19],"system":[21],"memory,":[22],"the":[23,64,69,78,86,90,95,120,123,136,161,171,177,192,201],"nonpaged":[24,137],"pool,":[25],"contains":[26],"lots":[27],"information":[29,45],"about":[30],"currently":[31],"and":[32,145,200],"formerly":[33],"active":[34],"processes.":[35],"As":[36],"this":[37,83,128],"paper":[38,84,186],"shows,":[39],"more":[40],"than":[41],"90%":[42],"such":[44],"be":[47,61,73],"retrieved":[48],"even":[49],"24":[50],"h":[51],"after":[52],"process":[53,66],"termination":[54],"under":[55],"optimum":[56],"conditions.":[57],"Great":[58],"care":[59],"must":[60],"taken":[62],"as":[63],"acquisition":[65],"usually":[67],"affects":[68],"contents":[71],"to":[72,107,169],"acquired.":[74],"In":[75,151],"order":[76],"minimize":[77],"impact":[79],"on":[80,122,142],"volatile":[81],"data,":[82],"for":[85,194],"first":[87],"time":[88,110],"analyzes":[89],"pool":[91,138],"allocation":[92],"mechanism":[93],"Microsoft":[96],"Windows":[97],"operating":[98,125],"system.":[99,126],"It":[100],"describes":[101],"test":[103],"arrangement,":[104],"which":[105],"allows":[106],"obtain":[108],"series":[111],"images,":[115],"while":[116],"it":[117,130],"also":[118],"reduces":[119],"effect":[121],"observed":[124],"Using":[127],"environment":[129],"was":[131,181],"found":[132],"that":[133,180],"allocations":[134],"from":[135],"are":[139],"reused":[140],"based":[141],"their":[143],"size":[144],"last":[147],"in-first":[148],"out":[149],"schedule.":[150],"addition,":[152],"passive":[154],"compaction":[156],"strategy":[157],"may":[158],"apply.":[159],"So,":[160],"creation":[162,202],"new":[165],"object":[166,175],"is":[167],"likely":[168],"eradicate":[170],"evidence":[172],"an":[174],"same":[178],"class":[179],"destructed":[182],"just":[183],"before.":[184],"The":[185],"concludes":[187],"discussion":[190],"implications":[193],"incident":[195],"response":[196],"procedures,":[197],"examinations,":[199],"tools.":[205]},"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W1982531768","counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":3},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":6},{"year":2014,"cited_by_count":5},{"year":2013,"cited_by_count":12},{"year":2012,"cited_by_count":3}],"updated_date":"2025-01-06T04:41:04.068330","created_date":"2016-06-24"}