Implementing Boot Control for Windows Vista
نویسندگان
چکیده
A digital forensic logging system must prevent the booting of unauthorized programs and the modification of evidence. Our previous research developed Dig-Force2, a boot control system for Windows XP platforms that employs API hooking and a trusted platform module. However, Dig-Force2 cannot be used for Windows Vista systems because the hooked API cannot monitor booting programs in user accounts. This paper describes an enhanced version of Dig-Force2, which uses a TPM and a white list to provide boot control functionality for Windows Vista systems. In addition, the paper presents the results of security and performance evaluations of the boot control system.
منابع مشابه
Usability of Windows Vista Firewall: A Laboratory User Study
In this project we conducted a user study of Microsoft Windows Vista Firewall: a lab study followed by a questionnaire to evaluate the usability of Vista’s personal firewall. Our results show that the main problem with Windows Vista Firewall is that many users are unable to open the Advanced Management Interface of Windows Vista Firewall. Our overall impression was that users were relatively un...
متن کاملAnalysis of the Windows Vista Security Model
This paper provides an in-depth technical assessment of the security improvements implemented in Windows Vista, focusing primarily on the areas of User Account Protection and User Interface Privilege Isolation. This paper discusses these features and touches on several of their shortcomings. It then demonstrates how it is possible to combine these attacks to gain full control over the machine f...
متن کاملAcquisition of Network Connection Status Information from Physical Memory on Windows Vista Operating System
A method to extract information of network connection status information from physical memory on Windows Vista operating system is proposed. Using this method, a forensic examiner can extract accurately the information of current TCP/IP network connection information, including IDs of processes which established connections, establishing time, local address, local port, remote address, remote p...
متن کاملPerformance Evaluation of Recent Windows Operating Systems
The primary goal of most OSs (Operating Systems) is the efficient use of computer systems software and hardware resources. Since Windows OSs are most widely used OS for personal computers, they need to satisfy needs of all different kind of computer systems users. In comparison with Windows XP, new versions of the Windows OS; namely Windows Vista and Windows 7, introduce a number of new feature...
متن کاملCore system event analysis on windows vista
Event Tracing for Windows (ETW) has been the key instrumentation technology on Windows platforms for years. Many core operating system components have been instrumented with ETW, providing a basis for system activity analysis and problem diagnosis for a number of developers and tools. The upcoming Windows Vista ® operating system contains many new events, in response to the growing need to diag...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2009