Live Information Discovery of the P2P Instant Messaging Based on Skype's Finger Printing

Abstract

Skype has been considered as the most popular VoIP application program since the last several years because of its distinguished high call completion rate and better sound quality as well as its traversal of firewall or NAT. From network forensics point of view, there are some finger printings that Skype left behind and could be collected as the counter strategy with respect to the violation of computer usages or even the cyber crimes. Hence, in this paper, we investigated the possible finger printings of the P2P IM during a Skype session. Windows Registry and RAM will be the focuses in this research. Our experiment demonstrated that the contents of the IM of Skype between two communicating parties will be temporarily saved in the RAM, which will be disappeared once the computer was powered off. Consequently, live data acquisition will be performed to fulfill the information discovery of the P2P IM during a Skype communication session.