A universal taxonomy and survey of forensic memory acquisition techniques. (March 2019) - Latzo, Tobias; Palutke, Ralph; Freiling, Felix
Abstract: Main memory analysis plays an increasingly important role in today's digital forensic analysis. It can be used to retrieve encryption keys or to analyze malware that solely resides in RAM. Typically, the memory is acquired prior to analysis. As of today, there exist a large number of different techniques and tools to accomplish this task that all have their own advantages and disadvantages and appear to be incompareable. In this paper, we define a taxonomy of acquisition methods based on a well-defined partial order that generalizes the concept of ring-based privilege separation. Using this taxonomy, we provide a comprehensive survey of state-of-the-art memory acquisition techniques that is agnostic towards the used operating system and the hardware architecture.