Memory FORESHADOW: Memory FOREnSics of HArDware CryptOcurrency wallets - A Tool and Visualization Framework

【Author】 Thomas, Tyler; Piscitelli, Mathew; Shavrov, Ilya; Baggili, Ibrahim

【Source】FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION

【影响因子】1.805

【Abstract】We present Memory FORESHADOW: Memory FOREnSics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client memory forensics. Our exploratory analysis revealed forensically relevant data in memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the Ledger and Trezor hardware wallet clients. The framework can be generalized for use in future memory forensics work. (C) 2020 The Author(s). Published by Elsevier Ltd on behalf of DFRWS. All rights reserved.

【Keywords】Memory Forensics; Data recovery; Hardware wallet; Cryptocurrency; Bitcoin; Ethereum; Ledger; Trezor

【发表时间】2020 JUL

【收录时间】2022-01-02

【文献类型】

【主题类别】

--