Sciweavers

Share
DI
2007

Using every part of the buffalo in Windows memory analysis

8 years 6 months ago
Using every part of the buffalo in Windows memory analysis
All Windows memory analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a memory image. In some memory images up to 20% of all the virtual addresses in use point to so called “invalid” pages that cannot be found using a naive method for address translation. This paper explains virtual address translation, enumerates the different states of invalid memory pages, and presents a more robust strategy for address translation. This new method incorporates invalid pages and even the paging file to greatly increase the completeness of the analysis. By using every available page, every part of the buffalo as it were, the examiner can more accurately recreate the state of the machine as it existed at the time of imaging.
Jesse D. Kornblum
Added 13 Dec 2010
Updated 13 Dec 2010
Type Journal
Year 2007
Where DI
Authors Jesse D. Kornblum
Comments (0)
books