Certificação

I N18- 1 S 90 14 S 1
Vl e , u br,09 o m 4N m e120 u

Po ed g o rcei s f n

Te o rhnent nl h Fut I raoa t i C neec o Frni ofrne f oes c C mue S i c o ptr c ne e

I FS2 0 C C 09 o

w wI FSog w .oC .r C

Proceedings of the Fourth International Conference of Forensic Computer Science (ICoFCS’2009) / ABEAT (ed.) - Natal, Brazil, 2009, 122 pp. - ISSN 1980-1114

© Copyrigth 2009 by ABEAT ST SHC/NORTE CL Quadra 309 - Bloco D - nº 50 - sala 103 - Asa Norte Brasília DF - Brazil 70.755-540 Phone: [phone] www.abeat.org.br ISSN 1980-1114

REALIZATION
Honorary President Luiz Fernando Corrêa Director General - Brazilian Federal Police Honorary Vice-President Paulo Roberto Fagundes Technical-Scientific Director - Brazilian Federal Police General Chair Paulo Quintiliano da Silva Forensic Computer Crime Unit - Brazilian Federal Police Organization Team Bruno Werneck Pinto Hoelz Forensic Computer Crime Unit - Brazilian Federal Police Cris Amon Caminha da Rocha Forensic Computer Crime Unit - Brazilian Federal Police Marcelo Caldeira Ruback Forensic Computer Crime Unit - Brazilian Federal Police Itamar Almeida de Carvalho Forensic Computer Crime Unit - Brazilian Federal Police Reviewers Andreia Stanger Bruno Werneck Pinto Hoelz Cris Amon Caminha da Rocha Daniel Miranda Galileu Batista de Sousa Ivo Peixinho José Helano Matos Nogueira José Henrique Linhares Marcelo Abdalla Murilo Tito Paulo César Herrmann Paulo Quintiliano da Silva Sergio Luis Fava

ABEAT - Associação Brasileira de Especialistas em Alta Tecnologia ST SHC/NORTE CL Quadra 309 - Bloco D - nº 50 - sala 103 - Asa Norte Brasília DF - Brazil 70.755-540 Phone: [phone]

CONTENTS

BEST PAPER Automated Malware Invariant Generation

Rachid Rebiha, Arnaldo V. Moura ...............................................................................................

7 15 21

Extração de vestígios do Windows Live Messenger 2009

Marcelo Henrique Ferreira de Medeiros, Galileu Batista de