Research Article
Quantifying Paging on Recoverable Data from Windows User-Space Modules
@INPROCEEDINGS{10.1007/978-3-031-06365-7_1, author={Miguel Mart\^{\i}n-P\^{e}rez and Ricardo J. Rodr\^{\i}guez}, title={Quantifying Paging on Recoverable Data from Windows User-Space Modules}, proceedings={Digital Forensics and Cyber Crime. 12th EAI International Conference, ICDF2C 2021, Virtual Event, Singapore, December 6-9, 2021, Proceedings}, proceedings_a={ICDF2C}, year={2022}, month={6}, keywords={Digital forensics Memory forensics Windows modules Paging Malware}, doi={10.1007/978-3-031-06365-7_1} }- Miguel Martín-Pérez
Ricardo J. Rodríguez
Year: 2022
Quantifying Paging on Recoverable Data from Windows User-Space Modules
ICDF2C
Springer
DOI: 10.1007/978-3-031-06365-7_1
Abstract
Memory forensic analysis enables a forensic examiner to retrieve evidence of a security incident, such as encryption keys, or analyze malware that resides solely in memory. During this process, the current state of system memory is acquired and saved to a file denoted asmemory dump, which is then analyzed with dedicated software for evidence. Although a memory dump contains large amounts of data for analysis, its content can be inaccurate and incomplete due to how an operating system’s memory management subsystem works: page swapping, on-demand paging, or page smearing are some of the problems that can affect the data that resides in memory. In this paper, we evaluate how these issues affect user-mode modules by measuring the ratio of modules that reside in memory on a Windows 10 system under different memory workloads. On Windows, a module represents an image (that is, an executable, shared dynamic library, or driver) that was loaded as part of the kernel or a user-mode process. We show that this ratio is particularly low in shared dynamic library modules, as opposed to executable modules. We also discuss the issues of memory forensics that can affect scanning for malicious evidences in particular. Additionally, we have developed a Volatility plugin, dubbedresidentmem, which helps forensic analysts obtain paging information from a memory dump for each process running at the time of acquisition, providing them with information on the amount of data that cannot be properly analyzed.
