User data persistence in physical memory

  • Authors:

  • Jason Solomon;Ewa Huebner;Derek Bem;Magdalena Szeynska

  • Affiliations:

  • School of Computing and Mathematics, University of Western Sydney, Penrith Campus, Locked Bag 1797, Penrith South DC, NSW 1797, Australia;School of Computing and Mathematics, University of Western Sydney, Penrith Campus, Locked Bag 1797, Penrith South DC, NSW 1797, Australia;School of Computing and Mathematics, University of Western Sydney, Penrith Campus, Locked Bag 1797, Penrith South DC, NSW 1797, Australia;Institute of Electronic Systems, Warsaw University of Technology, Poland

  • Venue:
  • Digital Investigation: The International Journal of Digital Forensics & Incident Response
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper we present the results of experiments we conducted on Suse Linux and Windows XP systems to determine the age of user process data in physical memory. To be able to measure the age of pages we used an artificial load program which time-stamps data segment and block device cache pages. Our goal was to compare the behaviour of both systems and to determine whether the rate of decay for user data depends on the demand for physical memory. Our findings show that Windows and Linux systems preserve almost the same number of pages with user data, and the age distribution of these pages does not change significantly with the level of demand.