Evaluating the Impact of Sandbox Applications on Live Digital Forensics Investigation

Bashir, Reem and Janicke, Helge and Zeng, Wen (2021) Evaluating the Impact of Sandbox Applications on Live Digital Forensics Investigation. EAI Endorsed Transactions on Security and Safety, 7 (25). e2. ISSN 2032-9393

[thumbnail of eai.8-4-2021.169179.pdf]
Available under License Creative Commons Attribution No Derivatives.

Download (2MB) | Preview


Sandbox applications can be used as anti-forensics techniques to hide important evidence in the digital forensics investigation. There is limited research on sandboxing technologies, and the existing researches on sandboxing are focusing on the technology itself. The impact of sandbox applications on live digital forensics investigation has not been systematically analysed and documented. In this study, we proposed a methodology to analyse sandbox applications on Windows systems. The impact of having standalone sandbox applications on Windows operating systems image was evaluated. Experiments were conducted to examine the artefacts of three sandbox applications: Sandboxie, BufferZone and ToolWiz Time Freeze on Windows 7, Windows Server12 R2 and Windows XP operating systems in 2018. We found that (1) only the installed applications can be found after deleting the ToolWiz Time Freeze content. Unlike Sandboxie, the data can be retrieved from the memory images even after deleting the application’s content if the system was not restated; (2) not all the sandbox applications data will be deleted after restarting the systems, e.g., BufferZone’s content can be retrieved even after restarting the system.

Item Type: Article
Uncontrolled Keywords: sandbox applications, live forensics, Cyber security, security investigation, security forensics
Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
QA75 Electronic computers. Computer science
T Technology > T Technology (General)
Depositing User: EAI Editor IV
Date Deposited: 09 Jul 2021 08:32
Last Modified: 09 Jul 2021 08:32
URI: https://eprints.eudl.eu/id/eprint/4409

Actions (login required)

View Item
View Item