Forensics Examination of Volatile System Data Using Virtual Introspection

摘要

While static examination of computer systems is an important part of many digital forensics investigations, there are often important system properties present only in volatile memory that cannot be effectively recovered using static analysis techniques,