An Ontology for Digital Forensics in IT Security Incidents - OPUS

20 CHAPTER 4. FORENSICS
entry contains the name of a le, reference to corresponding metadata
entries and a list of le name entries for all children.
• Metadata
Similar to the le name entries there is at least one metadata entry
for each le. This entry contains additional information for a le like
access rights, ownership, access and creation times and additional ags.
Furthermore it contains links to le name entries and data units.
• Application specific
Some le system types allow special information like journals, quota
restrictions, logs or other le system specic options.
How the example from section 3.1 splits up to these categories is shown later
in section 4.3.1 that explains the corresponding tool.
4.2.2 Random Access Memory
Similar to the hard disk, the structure of the data in random access memory
depends on the system it is managed by. A big dierence to the hard disk
is that the random access memory is volatile. This means, its content is lost
when the power is taken away from it.
There is not yet a source for this as the model is developed within Siemens
CERT and will be published. Like the hard disk, the memory structures can
be mapped to a meta structure as shown in gure 4.2. [Schreck et al. Siemens
CERT, ]
Memory
Memory
System
Architecture
Metadata
Metacode
Data
Code
Memory
Organization
Metadata
Runtime
Organization
Metadata
OS-specific
Data
Application
Data
OS-specific
Code
Application
Code
Figure 4.2: Random access memory structure
The categories contain the following information[Schreck et al. Siemens
CERT, ]:
• Memory System Architecture
This category contains information that is necessary to boot a system.