Time aspect of information stored on Windows application memory

In today digital investigation, forensic time aspect of information has become an important part of digital forensic research. Vital user input information can be gathered from the physical memory of computer systems. Digital forensic community demand accurate data collection, preservation, examination, validation, data analysis and presentation. This process has become the most important aspect of digital investigation. The extraction of forensically relevant evidence from the physical memory can reveals users´ actions. This research will report the evidence that can be extracted and how that evidence changes with the length of time that the system is switched on when the application is still opened. In this experiment, the qualitative assessment of user input on some commonly used applications will be discussed.