20.500.12556/DKUM-21915 DIGITALNA PREISKAVA NEOBSTOJNIH PODATKOV OPERACIJSKIH SISTEMOV WINDOWS DIGITAL INVESTIGATION OF WINDOWS OPERATING SYSTEMS VOLATILE DATA Tematika diplomske naloge obsega digitalno preiskavo neobstojnih podatkov operacijskih sistemov Windows. Vzroki in dejanja, ki privedejo do uvedbe preiskave so različni. Neodvisno od uporabljenega orodja in verzije preiskovanega operacijskega sistema potrebujemo metodologijo, ki zagotavlja dosledno zajetje ter analizo neobstojnih podatkov. Preiskavo zato vedno vodimo v štirih fazah, pri čemer zajete podatke preoblikujemo v dokaze. Pomemben vir neobstojnih podatkov predstavlja fizični pomnilnik. Predstavili bomo nekatere teoretične osnove delovanja pomnilnika, načine za ohranitev njegovega stanja ter opravili analizo izdelane slike. Subject of this work covers digital investigation of Windows operating systems volatile data. Causes and actions that lead to initiation of the investigation are different. Independent of the tools used and the operating system under investigation, there is a need for methodology to ensure that volatile data is captured and analyzed in consistent manner. Therefor we always conduct investigation in four phases. The process transforms collected data into evidence. Physical memory is important source of volatile data. We will introduce some theoretical basis, ways for collecting physical memory and perform analysis of produced images. digitalna preiskava neobstojni podatki fizični pomnilnik volatility okvir operacijski sistemi Windows digital investigation volatile data physical memory volatility framework Windows operating systems true true false [S. Garantini] Slovenski jezik Angleški jezik Diplomsko delo 2012-01-19 19:13:57 2012-03-14 14:40:57 2022-04-14 11:00:11 2023-12-28 03:23:39 2012 0 Maribor 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 004.6.056:004.451(043.2) 16166934 URN:SI:UM:DK:9RCLFHVY VS_Garantini_Slavko_2012.pdf VS_Garantini_Slavko_2012.pdf 1 B6763416DE612975AD0B18B3F96E7F0A a72f465d70220c7e992b470aaa917785a145dbee6f9d77e239d8a782902162b6 f8a2933e-7c05-11eb-bb7a-00155d0001ca 20.500.12556/dkum/fef55710-83d2-45fc-944c-058d7bb2c30b https://dk.um.si/Dokument.php?lang=slv&id=28028 Fakulteta za elektrotehniko, računalništvo in informatiko 0 0 0