Memory Analysis in Criminal Investigations

This chapter provides the reader with an introduction to memory analysisMemory analysis, in a law enforcement, using the open-sourceOpen-source tool VolatilityVolatility 2.6. Using VolatilityVolatility rather than treating a memory dumpMemory dump as a big blob of data allows the examiner to complete a more structured analysis. This chapter demonstrates how to use VolatilityVolatility to find several key artifactsArtifact including list of users on the system, files loaded into memoryMemory, and using YARAYARA to do free-text searches. Looking at memory analysisMemory analysis for use in law enforcement, it usually comes down to analyzingAnalyzing a memory dumpMemory dump in order to find information about how a computer has been used. The aim of the chapter is to demonstrate how to accomplish that by showing the reader the basic functionality of VolatilityVolatility so that the reader can continue to learn memory analysisMemory analysis on his own.