Memory Analysis

Computer memoryMemory (RAM) is a great source of forensic artifactsArtifact as it contains information that the computer worked on since the last reboot. Also, information must take its true unencrypted form in memoryMemory, in order to be meaningful for the user. From a forensic perspective, a memory dumpMemory dump can contain vital information such as passwordsPassword, decrypted versions of encrypted data, and malwareMalware in its true form. It is therefore an important place to look. However, the way that memoryMemory is structured is somewhat unlike how secondary storage is structured, and the intent of this chapter is to introduce the reader to some central concepts relating to memoryMemory management. While an in-depth discussion on all that has to do with memoryMemory management seems over the top, a forensic examiner should be familiar with the key concept presented in this chapter in order to understand the constraints and possibilities with a memory analysisMemory analysis.