An Ontology for Digital Forensics in IT Security Incidents - OPUS

4.2. DATA 21
It comprises for example physical memory layout information, boot
code, setup code, and the size of the page tables.
• Metadata
Memory Organization
This is the data that contains information about the organization
of the memory. It is necessary to manage the memory and includes
for example the page tables.
Runtime Organization
This is the data that is necessary for the management of data
within the memory. It comprises for example the process list and
the IO management.
• Metacode
This section contains the code necessary to operate the system and
inuence the behaviour of the operating system. This includes for
example interrupt service routines, page fault handler, IO code, and
scheduler.
• Code
OS-specific
This is the code that is used by the operating system to implement
OS-specic functionality. It comprises for example daemon
processes and idle process.
Application
This is the code that is used by user processes.
• Data
OS-specific
This is the data that is used by the operating system processes.
Application
This is the data that is used by the user processes.
4.2.3 Additional information
The data in this section diers from the already mentioned one as it can be
derived from one or more of them.