Forensic memory analysis: Files mapped in memory

Digital Investigation

Volumn 5, Issue SUPPL., 2008, Pages

  van Baar, R B ^a   Alink, W ^a   van Ballegooij, A R ^a  

^a Netherland Forensic Institute   (Netherlands)

Author keywords

Digital forensics; Memory mapped files; Microsoft Windows XP SP2; Volatile evidence

Indexed keywords

COMPUTER APPLICATIONS; DIGITAL COMPUTERS;

FILE CONTENTS; INFORMATION PROCESS; MEMORY ANALYSIS; MEMORY-MAPPED FILE; MICROSOFT WINDOWS XP SP2; VOLATILE EVIDENCE;

DIGITAL FORENSICS;

EID: 48749118027     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2008.05.014     Document Type: Article

References (8)

1. Alink W., Bhoedjang R.A.F., Boncz P.A., and de Vries A.P. XIRAF - XML-based indexing and querying for digital forensics. Digital Investigation 3S (2006) S50-S58
2. Carvey H. Windows forensic analysis (2007), Syngress [chapter 3]
3. Dolan-Gavitt B. The VAD tree: a process-eye view of physical memory. Digital Investigation 4S (2007) S62-S64
4. Farmer D., and Venema W. Forensic discovery. Third Printing (2005), Pearson Education [chapter 8.15]
5. Garfinkel S.L. Carving contiguous and fragmented files with fast object validation. Digital Investigation 4S (2007) S1-S12
6. Kornblum J.D. Using every part of the buffalo in Windows memory analysis. Digital Investigation 4 (2007) 24-29
7. Schuster A. Searching for processes and threads in Microsoft Windows memory dumps. Digital Investigation 3S (2006) S10-S16
8. Schuster A. Pool allocations in windows memory forensics. IMF (2006). http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/imf/imf2006/23_Schuster-PoolAllocations.pdf