BodySnatcher: Towards reliable volatile memory acquisition by software

Digital Investigation

Volumn 4, Issue SUPPL., 2007, Pages 126-134

  Schatz, Bradley ^a  

^a Evimetry   (Australia)

Author keywords

Digital forensics; Memory acquisition; Memory imaging; Volatile memory forensics

Indexed keywords

COMPUTER OPERATING SYSTEMS; IMAGING SYSTEMS; RELIABILITY THEORY; SECURITY OF DATA;

DIGITAL FORENSICS; MEMORY ACQUISITION; MEMORY IMAGING; VOLATILE MEMORY FORENSICS;

DATA STORAGE EQUIPMENT;

EID: 34447528955     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2007.06.009     Document Type: Article

References (22)

1. Aloni D. Cooperative Linux. In: Linux symposium, Ottawa, CA, 2004.
2. Boileau A. Hit by a bus: physical access attacks with Firewire (2006). [cited April 2007]. Available from:
3. Bilby D. Low down and dirty: anti-forensic rootkits (2006). [cited May 2007]. Available from:
4. Becher M., Dornseif M., and Klein C.N. FireWire: all your memory are belong to us (2005). [cited April 2007]. Available from:
5. Barham P, Dragovic B, Fraser K, Hand, S, Harris T, et al. Xen and the art of virtualization. In: ACM symposium on operating systems principles, Bolton Landing, NY; 2003.
6. Carrier B.D., and Grand J. A hardware-based memory acquisition procedure for digital investigations. J Digit Investig 1 1 (2004)
7. Casey E. Practical approaches to recovering encrypted digital evidence. Int J Digit Evid 1 3 (2002)
8. Carvey H. lsproc released (2006). [cited April 2007]. Available from:
9. DFRWS. Memory analysis challenge (2005). [cited April 2007]. Available from:
10. Drake C., and Brown K. PANIC! UNIX system crash dump analysis handbook (1995), Pearson Education
11. Farmer D., and Venema W. Forensic discovery (2004), Addison Wesley Professional
12. Garner G.M. Forensic acquisition utilities (2006). [cited April 2007]. Available from:
13. Goyal V, Biederman EW, Nellitheertha H. Kdump, a kexec-based kernel crash dumping mechanism. In: Linux symposium, Ottowa, CA, 2005.
14. Garner G.M. Overview of kntlist analysis tool (2005). [cited April 2007]. Available from:
15. MicroSoft. Windows feature lets you generate a memory dump file by using the keyboard (2007). [cited April 2007]. Available from:
16. Petroni N.L., et al. FATKit: a framework for the extraction and analysis of digital forensic data from volatile system memory. Digit Investig 3 4 (2006)
17. Rutlowska J. Beyond the CPU: cheating hardware based RAM forensics (2007). [cited April 2007]. Available from:
18. Ring S., and Cole E. Volatile memory computer forensics to detect kernel level compromise. Lecture notes in Computer Science (2004) p. 158-70
19. Schuster A. Searching for processes and threads in Microsoft Windows memory dumps. In: Digital forensics workshop (DFRWS), 2006.
20. Sparks S., and Butler J. Shadow walker: raising the bar for Windows rootkit detection. [cited 23 May 2007]. Available from: (2005).
21. Vidstrom A. Memory dumping with NTSystemDebugControl (2006). [cited April 2007]. Available from:
22. Vidstrom A. Forensic memory dumping intricacies - PhysicalMemory, DD, and caching issues (2006). [cited April 2007]. Available from: