The impact of Microsoft Windows pool allocation strategies on memory forensics

Digital Investigation

Volumn 5, Issue SUPPL., 2008, Pages

  Schuster, Andreas ^a  

^a DEUTSCHE TELEKOM LABORATORIES   (Germany)

Author keywords

Microsoft Windows; Pool memory; Process Persistence; Volatile data

Indexed keywords

LAKES;

ACQUISITION PROCESS; ALLOCATION MECHANISM; FORENSIC EXAMINATIONS; MICROSOFT WINDOWS; POOL MEMORY; PROCESS PERSISTENCE; VOLATILE DATA; WEALTH OF INFORMATION;

WINDOWS OPERATING SYSTEM;

EID: 48949095226     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2008.05.007     Document Type: Article

References (17)

1. Chow J., Pfaff B., Garfinkel T., and Rosenblum M. Shredding your garbage: reducing data lifetime through secure deallocation. Proc. 14th USENIX security symposium (August 2005). [accessed 01.03.08]
2. Farmer D., and Venema W. Forensic discovery (2005), Addison Wesley Professional, Upper Saddle River, NJ, USA
3. fuzen_op. FU Rootkit (2005). [accessed 01.01.08]
4. IndigoSTAR Software. Perl2Exe (August 2007), IndigoSTAR, Mississauga, Ontario, Canada. [accessed 01.03.08]
5. Johnson R. Memory allocator attack and defense. ToorCon Seattle (May 2007). [accessed 01.03.08]
6. Microsoft Corporation. Debugging tools for Windows, 32 Bit, Version 6.8.4.0 (October 2007), Microsoft Corporation, Redmond, WA, USA. [accessed 01.03.08]
7. Microsoft Corporation. ExAllocatePoolWithTag (2008), Microsoft Corporation, Redmond. [accessed 01.03.08]
8. Russinovich M.E., and Salomon D.A. Windows internals (2005), Microsoft Press, Redmond, WA, USA 4th ed.
9. Schuster A. Searching for processes and threads in Microsoft Windows memory dumps. Digital Investigation 3 suppl. 1 (September 2006) 10-16 10.1016/j.diin.2006.06.010
10. Schuster A. Pool allocations as an information source in windows memory forensics. In: Göbel O., Schadt D., Frings S., Hase H., Günther D., and Nedon J. (Eds). IT-incident management & IT-forensics - IMF 2006. Lecture notes in informatics vol. P-97 (18 October 2006) 104-115
11. Schuster A. PTFinder Version 0.3.05 (November 2007). [accessed 01.03.08]
12. Schuster A. PoolTools Version 1.3.0 (November 2007). [accessed 01.03.08]
13. SoBeIt. How to exploit Windows kernel memory pool. XCon (August 2005). [accessed 01.03.08]
14. Solomon J., Huebner E., Bem D., and Szeżynska M. User data persistence in physical memory. Digital Investigation 4 2 (2007) 68-72 10.1016/j.diin.2007.03.002
15. VMware, Inc. VMware products (2008), VMware, Inc., Palo Alto, CA, USA. [accessed 01.03.08]
16. Walters A., and Petroni N.L. Volatools: integrating volatile memory forensics into the digital investigation process. BlackHat DC (February 2007). [accessed 01.03.08]
17. Walters A., and Petroni N.L. The volatility framework: volatile memory artifact extraction utility framework (2008). [accessed 28.02.08]