Search

This article has been retracted: please see Elsevier Policy on Article Withdrawal (http://www.elsevier.com/locate/withdrawalpolicy).This article has been retracted at the request of the Editor.The authors have plagiarized part of a paper that had already appeared in Digital Investigation, 8 (2011) 3 - 22. http://dx.doi.org/10.1016/j.diin.2011.06.002. One of the conditions of submission of a paper for publication is that authors declare explicitly that their work is original and has not appeared in a publication elsewhere. Re-use of any data should be appropriately cited. As such this article represents a severe abuse of the scientific publishing system. The scientific community takes a very strong view on this matter and apologies are offered to readers of the journal that this was not detected during the submission process.

In the paper, we discuss the impact of performing live registry response on the target windows system during loading memory acquisition tools. Every running tool on an investigated system leaves artifacts and changes the system state. Therefore, we should verify the registry evidences in court exacted from memory invalid or not. Firstly, we measure the memory uncertainty in a natural running state (without any other extra tasks) and calculate the blurriness both during loading acquisition tools for live forensics. Then, we employ the MemoryAnalyzer which is developed by ourselves to extract the registry from the acquired memory. Finally, we analyze and compare keys, subkeys and values of the extracted registry hive fives with the original one using Windows Registry File Viewer. Experiments on Windows XP Service Pack 2 under VMware® Workstation show that, the memory state are mainly changed by the loading acquisition tool although it is also influenced by its natural running. And what's interesting is that the novel extracted registry subkeys and values can not be deleted by the live memory acquisition tool, just added some keys and values related with acquisition tools in the SYSTEM hive file, and modified key values (usually represent visited or running time) in the SOFTWRE and NTUSER.DAT hive files. Therefore, the registry is trustable even that it is extracted from acquired memory.

While biometrics presents obvious advantages over password and token-based security, the security concerns that biometric authentication raises need to be addressed. In this paper, we outlined cancelable palmprint binary orientation co-occurrence vector (BOCV) based on anisotropic filter(AF) using feedforward–feedback nonlinear dynamic filter (FFNDF) and then the independent matching scores is fused at the score level, which can efficiently protect the security of template and enhance the user's privacy. The cancelable system can provide large re-issuance ability and can be implemented very fast for real applications. It also has better robustness--- even in the stolen-token case, the result just reverts to the original performance without loss in performance and it can still achieve state-ofthe-art authentication accuracy, i.e., the EER is 0.07%.. Experiments on PolyU Palmprint Database confirm the effectiveness of the proposed approach.