Hi are there any ways of extracting data from the application level based on a forensic point of view? Much seems to involve low level data and a knowledge of assembly and C++?
Any info appreciated,thanks…
Can you give more details, or an example of what you want to achieve
just really puting it out there unsure of what exactly my approach would be,cant find any literature on it. I guess the types of applications that were in use before the system was compromised etc,is this any clearer? )
I'm still unclear as to what you mean by 'application level'. Getting what applications were on the system is trivial from a disk analysis perspective…getting which ones were in use at the time of acquisition is similarly trivial from a memory analysis perspective.