Memory Analysis Tools

As has been discussed throughout this book, the computer memoryMemory is a good source of information that should not be overlooked during a forensic examinationExamination. However, the traditional tools used for forensic examinationExamination are not built to handle memory dumpsMemory dump very well. As has been discovered in the previous chapter, the memoryMemory structure is vastly different from the structure of a secondary storage device. Further, there are differences in how memoryMemory is allocated between different operating system versions. For that reason, a forensic examiner needs to have a tool for memory analysisMemory analysis, which is capable of interpreting memory dumpsMemory dump from different operating system versions. One such tool is VolatilityVolatility, which is introduced and described in this chapter in a practical manner. Conveniently enough, VolatilityVolatility is open sourceOpen-source and free to use. Another tool introduced in this chapter is RedlineRedline, that is, a graphical tool designed for malwareMalware analysis in memory dumpsMemory dump.