Authors: R.B. van Baar (Netherlands Forensic Institute), W. Alink (Netherlands Forensic Institute), A.R. van Ballegooij (Netherlands Forensic Institute)
DFRWS USA 2008
Abstract
In this paper we describe a method for recovering files mapped in memory and to link mapped-file information process data. This information is forensically interesting, because it helps determine the origin and usage of the file and because it reduces the amount of unidentified data in a memory dump. To find mapped-file content, we apply several different techniques. Together, these techniques can identify approximately 25% of test memory dumps as being part of a memory-mapped file.