Using DEMF in process of collecting volatile digital evidence

Acquisition of volatile data for further forensic analysis still represents a challenge to both practitioners and researchers. The current tools used for acquisition of such data are focused exclusively on a way to capture content. However, the development of forensic science, in particular in the area of digital evidence in terms of the admissibility in court, has introduced additional elements to be evaluated. Mainly, the integrity of the collected digital evidence, authenticity and other elements of the digital chain of evidence to be presented in court. This paper describes a framework for capturing volatile data using Digital Evidence Management Framework (DEMF) with regards to integrity of captured data.