Memory Analysis Tools

Abstract

As has been discussed throughout this book, the computer memory is a good source of information that should not be overlooked during a forensic examination. However, the traditional tools used for forensic examination are not built to handle memory dumps very well. As has been discovered in the previous chapter, the memory structure is vastly different from the structure of a secondary storage device. Further, there are differences in how memory is allocated between different operating system versions. For that reason, a forensic examiner needs to have a tool for memory analysis, which is capable of interpreting memory dumps from different operating system versions. One such tool is Volatility, which is introduced and described in this chapter in a practical manner. Conveniently enough, Volatility is open source and free to use. Another tool introduced in this chapter is Redline, that is, a graphical tool designed for malware analysis in memory dumps.