GPU Forensics: Recovering Artifacts From The Gpus Global Memory Using Opencl

The purpose of this research is to perform a graphics recovery process on the GPU in line with the principles of computer forensics. The research tested the possibility of recovering artifacts of last visited web pages and last opened images from the GPUs global memory. The experiment deployed the OpenCL framework and tested JPEG, TIFF, and BMP graphic file formats of 64x64 pixels, 100x100 pixels, and 200x200 pixels in size. Other variables, such as the choice of OS, GPU, and GPU driver, were also tested to measure the effectiveness on the proposed method. The research indicates that recovering artifacts from the GPUs global memory is possible using a set of unique pixel patterns. The research highlights three challenges of implementing forensic techniques on GPUs: 1) elusive global memory allocation scheme of GPUs; 2) varying levels of support for different GPU drivers; and 3) the prerequisite of using certain types of OS and applications.