Principles-driven forensic analysis

摘要: It is possible to enhance our understanding of what has happened on a computer system by using forensic techniques that do not require prediction the nature attack, skill attacker, or details resources objects affected. These address five fundamental principles forensics. include recording data about entire operating system, particularly user space events and environments, interpreting at different layers abstraction, aided context in which they occurred. They also deal with modeling recorded as multi-resolution, finite state machine so results can be established high degree certainty rather than merely inferred.