Title :
Analysis of Download Accelerator Plus (DAP) for Forensic Artefacts
Author :
Yasin, Muhammad ; Wahla, Muhammad Arif ; Kausar, Firdous
Author_Institution :
Coll. of Signals, Dept. of Inf. Security, Nat. Univ. of Sci. & Technol., Rawalpindi, Pakistan
Abstract :
Download accelerator plus (DAP) is one of the most popular download managers due to its free availability, download speed and versatility. This software records download activities across multiple files which include history, registry, RAM, swap and temporary files. This paper analyzes (a) the log files (with .DAT extension), (b) windows registry entries, and (c) RAM and swap files from forensic view point. We also look at tools and techniques for extracting evidence. This research work describes a number of traces left behind after the use of DAP such as install location, download path, downloaded files and menu extensions to name a few, enabling digital investigators to search and interpret download activities. Moreover the study is supported by a tool, DAP forensic artefact collector (DAPFAC), that assists forensic examiners by providing valuable information which is retrieved from the windows registry and history files on the basis of analysis performed. The widespread use of DAP makes this analysis, an attractive option, ranging from law enforcement agencies to employees monitoring manager.
Keywords :
file organisation; security of data; DAP forensic artefact collector; download accelerator plus; download path; downloaded files; forensic artefacts; install location; log files; menu extensions; software records; windows registry entries; Conference management; Digital audio players; File servers; Forensics; History; Information analysis; Information security; Performance analysis; Technology management; Web server;
Conference_Titel :
IT Security Incident Management and IT Forensics, 2009. IMF '09. Fifth International Conference on
Conference_Location :
Stuttgart
Print_ISBN :
978-0-7695-3807-5
DOI :
10.1109/IMF.2009.11