Title: The impact of the antivirus on the digital evidence

Authors: Mohammed I. Al-Saleh

Addresses: Department of Computer Science, Jordan University of Science and Technology, P.O. Box 3030, Irbid, 22110, Jordan

Abstract: Digital forensics (DF) has a significant role in accusing cyber criminals and proving them guilty. A criminal, if possible, may manage to delete the crime evidences in order to deny her responsibility about the crime. As the antivirus (AV) becomes an essential security component, this paper studies the effect of the AV on the digital evidence. The AV intercepts many system operations to check if the involved data contain malicious contents. This paper studies the effect of the AV on data from forensics perspectives. We design representing experiments and check if the AV affects the RAM artefacts of the involved tasks. We test three common AVs and show that the AV has an obvious effect on the RAM artefacts. To the best of our knowledge, we are the first to study the impact of the AV on the digital evidence.

Keywords: digital forensics; digital evidence; cyber crime; antivirus; RAM artefacts; security.

DOI: 10.1504/IJESDF.2013.058656

International Journal of Electronic Security and Digital Forensics, 2013 Vol.5 No.3/4, pp.229 - 240

Received: 19 Dec 2012
Accepted: 05 Sep 2013
Published online: 26 Jul 2014 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article