Live Memory Forensic for Windows

Abstract

This work describes a functional, generic, broad-scoped investigative methodology for Windows memory analysis. The methodology applies equally to functional and damaged, or corrupted memory images and relies on Volatility. It is based on the author’s various memory analysis case studies. Summing it up succinctly, the methodology aids the forensic practitioner in squeezing the maximum amount of possible evidence from a memory image. The proposed methodology is suitable for analysts at all levels of investigative capability. It provides guidance in extracting maximum evidence using simple, commonplace tools and techniques familiar to digital forensic practitioners. As with all methodologies, nothing is written in stone; the forensic practitioner must be flexible and agile in responding to ever-changing investigative requirements. To assess the performance of various tools for gaining, analysing, and improving criminal evidence from volatile memory. A comparison of several tools is offered in order to provide a better understanding of the tools used.