Enhancing Reliability During Physical Memory Forensics: Strategies and Practices

Over the past decade, forensic investigators have incorporated memory forensics as a critical part of their investigation. Memory forensics yield substantial results that otherwise would be lost if the traditional “pull the plug” procedure is followed. However, physical memory is characterized by its dynamic and volatile nature that constantly changes the state of memory. This gives rise to challenges that reduce the reliability of physical memory forensics due to a lack of correctness, completeness, accuracy, or consistency of results. While contemporary work is focused on the acquisition or analysis of memory artifacts, little work has been done to ensure the reliability during memory forensics process. This paper presents the critical analysis of reliability in current date memory forensics and is an attempt to provide a thorough and systematic approach to ensure reliability during physical memory forensics. In the scope of this motive, the paper surveys the various memory management aspects that are crucial for reconstructing reliable memory artifacts. This includes identifying and exploring physical memory address layout, memory address space, memory address translation, memory access methods, or the low-level internal memory data structures, upon which memory forensics is reliant. The paper then identifies the prominent challenges faced during the memory forensics process and proposes a set of practices and possible suggestions to be followed or considered at different stages of physical memory forensics. These practices, if implemented, help to achieve maximum evidence reliability. Finally, a series of experiments are performed using three infamous memory acquisition tools: FTK Imager, Magnet RAM Capture, and Belkasoft RAM Capturer, on 32 GB and 16 GB Windows 10 machines to support the proposed claims. The paper also sketches the important future directions in memory forensics reliability.