A Review on Live Memory Acquisition Approaches for Digital Forensics
Sarishma Dangi, Diksha Bisht · 2022
Live memory forensics is the subfield of digital forensics where the volatile memory of a system is used for investigation purposes. Memory is acquired first and analyzed later. Acquiring volatile memory is a challenge in itself due to its very subtle nature. Various hardware- and software-based approaches are proposed for soundly acquiring RAM. In this work, we have provided a review of the existing approaches and outlined their limitations. A detailed review of existing work in the area is provided. Various memory dump formats are outlined along with their significance. We have discussed the methodology for acquiring memory dump for different live memory acquisition tools. A detailed comparison of various live memory acquisition tools is also provided. These tools are implemented on two Windows-based machines with 4 and 8GB of volatile memory. Finally, based on this implementation, the performance comparison is conducted for four prominent live memory acquisition tools used in digital forensics.