A survey of main memory acquisition and analysis techniques for the windows operating system

作者：Voemel Stefan; Freiling Felix C

来源：Digital Investigation, 2011, 8(1): 3-22.

DOI：10.1016/j.diin.2011.06.002

• Memory forensics
• Memory acquisition
• Memory analysis
• Live forensics
• Microsoft windows

Traditional, persistent data-oriented approaches in computer forensics face some limitations regarding a number of technological developments, e.g., rapidly increasing storage capabilities of hard drives, memory-resident malicious software applications, or the growing use of encryption routines, that make an in-time investigation more and more difficult. In order to cope with these issues, security professionals have started to examine alternative data sources and emphasize the value of volatile system information in RAM more recently. In this paper, we give an overview of the prevailing techniques and methods to collect and analyze a computer's memory. We describe the characteristics, benefits, and drawbacks of the individual solutions and outline opportunities for future research in this evolving field of IT security.

• 出版日期2011-7