Identifying Volatile Data from Multiple Memory Dumps in Live Forensics

Abstract

International audienceOne of the core components of live forensics is to collect and analyze volatile memory data. Since the dynamic analysis of memory is not possible, most live forensic approaches focus on analyzing a single snapshot of a memory dump. Analyzing a single memory dump raises questions about evidence reliability; consequently, a natural extension is to study data from multiple memory dumps. Also important is the need to differentiate static data from dynamic data in the memory dumps; this enables investigators to link evidence based on memory structures and to determine if the evidence is found in a consistent area or a dynamic memory buffer, providing greater confidence in the reliability of the evidence. This paper proposes an indexing data structure for analyzing pages from multiple memory dumps in order to identify static and dynamic pages

Firmware-assisted Memory Acquisition and Analysis tools for Digital Forensics

“…Recent work attempts to leverage multiple memory dumps using a tool called "CMAT". CMAT parses a memory dump to find active, inactive and hidden processes as well as system registry information [20] Complementing the existing semantic approaches, our work focuses on the process of acquiring the system state and thus, it is an enabling technology that enhances the value of existing memory analysis mechanisms.…”