Memory forensics tools: a comparative analysis. Issue 3 (3rd July 2022)

• Record Type: Journal Article
• Authors: Daghmehchi Firoozjaei, Mahdi; Habibi Lashkari, Arash; Ghorbani, Ali A.
• Is Part Of: Journal of cyber security technology. Volume 6:Issue 3(2022)
• Page Start: 149
• Page End: 173
• Publication Date: 2022-07-03
• Subjects: Cybersecurity -- incident response -- malware analysis -- memory forensics; Computer security -- Periodicals; Data encryption (Computer science) -- Periodicals; 005.805
• DOI: 10.1080/23742917.2022.2100036
• Languages: English
• ISSNs: 2374-2917

Abstract

ABSTRACT: As part of the incident response process, the memory forensics tools extract forensic artifacts and display them. Many memory forensics analysis tools are being developed to address the challenges of modern cybercrimes. Investigations are successful when they have an accurate analysis provided by a memory forensics tool that consumes resources reasonably. This paper presents a comparative analysis of three dominant memory forensics tools: Volatility, Autopsy, and Redline. We consider three malware behaviour scenarios and evaluate the forensics capabilities of these tools in each. We also experimentally measure the CPU and memory consumption of each for memory analysis in other operational states. We find that Volatility provides the most accurate memory analysis. Our measurements show that Redline consumes more CPU resources, and Autopsy needs more memory resources to analyze a memory image file. The results of our investigation will hopefully lead to tool improvement and more informed choices by users.