Towards a standardised strategy to collect and distribute application software artifacts
Abstract
Reference sets contain known content that are used to identify relevant or filter irrelevant content. Application profiles are a type of reference set that contain digital artifacts associated with application software. An application profile can be compared against a target data set to identify relevant evidence of application usage in a variety of investigation scenarios. The research objective is to design and implement a standardised strategy to collect and distribute application software artifacts using application profiles. An advanced technique for creating application profiles was designed using a formalised differential analysis strategy. The design was implemented in a live differential forensic analysis tool, LiveDiff, to automate and simplify data collection. A storage mechanism was designed based on a previously standardised forensic data abstraction. The design was implemented in a new data abstraction, Application Profile XML (APXML), to provide storage, distribution and automated processing of collected artifacts.
Cite
@article{arxiv.2103.03473,
title = {Towards a standardised strategy to collect and distribute application software artifacts},
author = {Thomas Laurenson and Stephen MacDonell and Hank Wolfe},
journal= {arXiv preprint arXiv:2103.03473},
year = {2021}
}
Comments
Conference paper, 6 pages, 3 tables, 4 figures