Memory forensics: The path forward. (March 2017)

• Record Type: Journal Article
• Authors: Case, Andrew; Richard, Golden G.
• Is Part Of: Digital investigation. Volume 20(2016)
• Page Start: 23
• Page End: 33
• Publication Date: 2017-03
• Subjects: Memory forensics -- Computer forensics -- Memory analysis -- Incident response -- Malware; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2016.12.004
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: Traditionally, digital forensics focused on artifacts located on the storage devices of computer systems, mobile phones, digital cameras, and other electronic devices. In the past decade, however, researchers have created a number of powerful memory forensics tools that expand the scope of digital forensics to include the examination of volatile memory as well. While memory forensic techniques have evolved from simple string searches to deep, structured analysis of application and kernel data structures for a number of platforms and operating systems, much research remains to be done. This paper surveys the state-of-the-art in memory forensics, provide critical analysis of current-generation techniques, describe important changes in operating systems design that impact memory forensics, and sketches important areas for further research.