Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive

Details

Serval ID
serval:BIB_E07A21E215F3
Type
Article: article from journal or magazin.
Collection
Publications
Title
Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive
Journal
Digital Investigation
Author(s)
Casey Peter, Lindsay-Decusati Rebecca, Baggili Ibrahim, Breitinger Frank
ISSN
1742-2876
Publication state
Published
Issued date
07/2019
Volume
29
Pages
S13-S21
Language
english
Abstract
Virtual Reality (VR) has become a reality. With the technology’s increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of anti-forensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable of reconstructing a visualization of the room setup a VR player was immersed into. In specific, we demonstrate that the VE, location, state and class of VR devices can be extracted from memory. Our work resulted in the first open source VR memory forensics plugin for the Volatility Framework. We discuss our findings, and our replicable approach that may be used in future memory forensics research.
Keywords
Law, Medical Laboratory Technology, Computer Science Applications
Web of science
Open Access
Yes
Create date
06/05/2021 11:01
Last modification date
06/05/2021 11:36
Usage data