Forensic Examination of RAM: Methods and Best Practices

A memory image can preserve evidence that may not exist on disk: running processes, open handles, network connections, injected regions, decrypted content and traces of user activity. The challenge begins after the RAM has been acquired. Investigators must determine whether the image is complete, choose tooling appropriate to the operating system, interpret artifacts conservatively, and… Read More »

Digital Forensic Analysis of System RAM 

A running computer can answer questions that a disk image cannot. Which processes existed just before a restart? What code and libraries were mapped into them? Was a network socket still open? A memory image may preserve clues to those questions, but it is not a complete recording of everything the machine did. It represents… Read More »

USB Forensic Analysis: Reveal Every USB Device That Has Connected to Your Computer

A USB drive may leave a trail on a Windows computer, but the trail is not a recording of everything a person did. Device installation, recognition, volume assignment, file access, and completed file transfer are different events. They are recorded by different components, under different conditions, and sometimes not recorded at all. The phrase “every… Read More »