A proposed investigative, generic broad-scoped Windows memory analysis methodology

PDF

Authors
  1. Carbone, R.
Corporate Authors
Defence Research and Development Canada, Valcartier Research Centre, Quebec QC (CAN)
Abstract
This work describes a functional, generic, broad-scoped investigative methodology for Windows memory analysis. The methodology applies equally to functional and damaged, or corrupted memory images and relies on Volatility, although other analysis frameworks will do. It is based on the author’s various memory analysis case studies. Summing it up succinctly, the methodology aids the forensic practitioner in squeezing the maximum amount of possible evidence from a memory image. The proposed methodology is suitable for analysts at all levels of investigative capability. It provides guidance in extracting maximum evidence using simple, commonplace tools and techniques familiar to digital forensic practitioners. As with all methodologies, nothing is written in stone; the forensic practitioner must be flexible and agile in responding to ever-changing investigative requirements.

Il y a un résumé en français ici.

Keywords
Forensics
Report Number
DRDC-RDDC-2017-R041 — Scientific Report
Date of publication
01 Mar 2017
Number of Pages
54
DSTKIM No
CA044939
CANDIS No
805317
Format(s):
Electronic Document(PDF)

Permanent link

Document 1 of 1

Date modified: