Forensic of Physical Memory Windows-based System Design and Implementation
Yue Lu · Xinxi wangluo anquan · 2011
Since the physical memory that contains a wealth of information of computer operations for real-time forensic analysis of physical memory,the current number of criminal investigations has become a hot research field of one of the issues.This access to technology by studying the physical memory,the memory process management model,keyword search technology and other related information technology background,to achieve the mirror of Windows physical memory,hidden processes and abnormal process detection,memory detection and analysis of sensitive information.Investigated by testing the user host,master user behavior and the operation of a large number of useful information for computer forensic investigations and information security protection provides a good means.