Title

A Compiled Memory Analysis Tool

Document Type

Conference Proceeding

Publication Date

1-1-2010

Abstract

The analysis of computer memory is becoming increasingly important in digital forensic investigations. Volatile memory analysis can provide valuable indicators on what to search for on a hard drive, help recover passwords to encrypted hard drives and possibly refute defense claims that criminal activity was the result of a malware infection. Historically, digital forensic investigators have performed live response by executing multiple utilities. However, using a single tool to capture and analyze computer memory is more efficient and has less impact on the system state (potential evidence). This paper describes CMAT, a self-contained tool that extracts forensic information from a memory dump and presents it in a format that is suitable for further analysis. A comparison of the results obtained with utilities that are commonly employed in live response demonstrates that CMAT provides similar information and identifies malware that is missed by the utilities. Abstract © Springer

Comments

The "Link to Full Text" on this page loads the PDF of the chapter, furnished open-access through the Springer Nature SharedIt content-sharing initiative. The publisher retains permissions to re-use and distribute this chapter in IFIP vol. 337.

DOI

10.1007/978-3-642-15506-2_14

Source Publication

IFIP Advances in Information and Communication Technology, vol. 337

Share

COinS