This website uses cookies to ensure you have the best experience. Learn more

Analyzing Windows Memory Essay

1339 words - 5 pages

Network investigation cases will rarely follow a rote path. However, most investigations have a few typical steps that are taken. One of the first steps is to acquire the memory if we are doing a live analysis. We can glean a myriad of invaluable information from a computer’s memory. This information may include hidden and running processes, when these processes were started and by whom, and what these specific processes were doing. Terminated objects may even be found in memory days after they were killed. The memory also will have the state of active network connections (Burdach).
“Windows memory analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a memory image,” (Schuster). Due to Windows caching large amounts of file data in memory we need to ensure we take invalid, mapped-file data into account. Memory is divided into 4096 bytes of data that is referred to as a page when in memory and a frame when on the hard drive. The memory manager assigns pages to a process to utilize as data storage for that process. When a page does not meet this criterion is said to be invalid (Burdach). In some memory images over 20% of the virtual addresses we find point to “invalid” pages that cannot be found using an average method for address translation (Schuster). By using every available page we can greatly increase the totality of the analysis and accurately recreate the machine as it existed at the time of imaging.
Data Carving can be done with memory just as with the hard disk. Data carving algorithms cannot recover fragments if a page is not yet loaded into memory, though. We can, however, reconstruct these fragments by interpreting file-mapping related structures (Shuster). File mappings are administered by data structures; which are allocated from memory pools. “A memory pool is a dynamic memory area allocated by the kernel where it stores administrative structures,” (Schuster). There are four byte numbers, pool tags, stored in the headers of the structures that will determine the type of pool structure (i.e. Proc, VAD, and Obtb). The memory pool structure is identified by its pool tag Eprocess Structure (Proc). The Proc contains pointers to the Object Table (Obtb) and the Virtual Address Descriptor (VAD) root (Dolan-Gavitt). The Obtb lists the private objects that are in use by the process. These objects include File objects (pool tag FILE), registry key objects (pool tag Key), and event objects (pool tag Evt) (Dolan Gavitt). The VAD root is the starting point of the VAD tree, and the VAD tree contains the memory ranges that are in use by a process (Dolan-Gavitt). Therefore we can reconstruct a process’ virtual address space utilizing the VAD tree.
The VAD tree has various pool tags that correlate to various types of Virtual Address Descriptors. Two of these common pool tags, Vad and VadL contain...

Find Another Essay On Analyzing Windows Memory

Netxray Manual Essay

1398 words - 6 pages the minimum requirements for the software to operate efficiently.NetXray as a complex software also have some hardware and software requirements. Central Processing Unit: 80386 of 66 Mhz processor is needed Video Display: minimum color monitor with 640x480 dpi is needed. Operating System: NetXray need Windows OS.It supports both Windows 95 and Windows NT. Memory: Minimum 16 MB RAM for Windows 95 and 24 MB for Windows NT Other Hardware : A CD

Novell Network for Company Security Essay

4530 words - 18 pages . You can kill a process that is not replying with kill command. Linux has true multitasking property. It is true because it is not like Windows. You can run up to twelve processes in the same time with no performance loss. Microsoft claims that Windows has the capability of multitasking but you cannot run two processes on the same time. Linux has virtual memory. It means that you can use your hard disk as memory. You make a swap partition on

What is Digital Forensic?

1795 words - 8 pages computer network system based on the data location. The location of data The retrieval sequence of data Register, peripheral memory, and cache First RAM (Random Access Memory) Second Network state Third Running processes Fourth Table 1: Order of volatility and retrieval sequence (Ciampa, 2012, p. 512) There are many different methods to copy digital evidence, however the two main methods are: • Bit-stream copy also known as Sector copy. It is a

Turing Notes

2380 words - 10 pages , PowerPoint, games, etc.Systems Software - helps the computer to manage its own resourcesExample: Windows, Mac OS, LinuxProgramming Editors/Environments - allow users to create their own application or systems softwareExample: Turing, JavaFocus on Software:5 Operating Systems:UNIXLinuxMicrosoft WindowsDOSMac OSTwo tasks which the operating systems performAccepting input from the keyboardManaging input and output between the computer and external

System Analysis

1197 words - 5 pages monitor power usage and temperature of the data floor.System AnalysisSystem analysis is "the process of analyzing a system were two tasks must be performed: Modelling the system and solving for the model's response" (Julia Maslov, n.d.). The system analysis process usually begins with a request of a product or process to be analyzed and at the end of the analysis a fully functional product or process should be able to be implemented. Within the

System analysis

1202 words - 5 pages the company is Company XX's main focus. It will be used to monitor power usage and temperature of the data floor.System AnalysisSystem analysis is "the process of analyzing a system were two tasks must be performed: Modelling the system and solving for the model's response" (Julia Maslov, n.d.). The system analysis process usually begins with a request of a product or process to be analyzed and at the end of the analysis a fully functional product

Mobile Phone Firmware Flashing for Nokia

9287 words - 37 pages INTRODUCTION1.1 OverviewFirmware can be found on any electronic devices such as mobile phone, computer hardware and measurement instrumentation. Basically the downloading codes to the Read Only Memory (ROM) are called flashing. The size of the ROM really depends on the complexity of the hardware and the microcode itself. Thus, the firmware incorporates the microcontroller, operating systems for user interface and data storage as well. Firmware

The Brain and Learning

1878 words - 8 pages properly citing the source of the work, is considered plagiarism. This will result in an unsatisfactory grade for the work submitted or for the entire course. It may also result in academic dismissal from the University. <ECE5001-8 <Herrera> Foundations of Early Childhood Education <Analyzing Brain Research Influence> <Add student comments here>Faculty Use Only<Faculty comments here><Faculty Name&gt

The Traumitized Life of Holden

2087 words - 9 pages Psychoanalysis is a method of analyzing the mind and helping emotional and mental disorders by inspecting the unconscious mind. According to Jacques Lacan, a psychiatrist, “Human behavior is often something of puzzle, requiring concerted acts of investigation to discover root causes and multiple effects” (105). Holden Caufield in the novel The Catcher in the Rye by J.D. Salinger, is a perplexed adolescent that is living in misery and agony from


1697 words - 7 pages choose the theater or acting as their career. A comprehensive approach to education can provide windows of opportunities for young people who are willing to open them. When I become a teacher, I want to instill in students an appreciation for literature--even if it doesn’t happen to be one of their passions. To appreciate something is to understand it and this is something I hope my students can leave my class doing. I also hope to

Comentary On Line Training

1607 words - 6 pages strategy for analyzing the data. After this process an evaluative conclusion is drawn that can be used to determine the overall success of the program. An assessment plan should always be included in the design of any training program. Otherwise it becomes difficult to determine the success of the program or to understand what changes will increase its effectiveness (Gordon 17). In order to maintain a training program that can work within

Similar Essays

Techincal Review

1819 words - 8 pages Technical Review of Windows Dump file The windows dump file is nothing just a screenshot of physical memory of system at point of time when that dump event is triggered. It would be having information like what all modules have been loaded into memory at that point of time and other sensitive information. This file can be used for solving many issues. The handling of such file is bit complex because of its large size. The windows dump

A Forensics Memory Study Of Malware In Android Operating Systems

2744 words - 11 pages attacks when they occur on mature operating system platforms such as Windows and Linux. However, due to the immaturity of Android memory image forensics, it is relatively problematic and time consuming to conduct such investigations on Android systems. In this research, we take advantage of recent advances in Android memory forensics technologies to explore a sample of these malware attacks, utilizing the open source digital forensics Volatility, a

Comparison Of Mac Vs. Pc Essay

1254 words - 5 pages provide in the constantly advancing technological world. In conjunction with computer hardware, the importance of a user-friendly operating system and it's ability to perform an diverse range of tasks is the crucial selling point of the Macs and PC buyers. Again, the two main operating systems in the world is the Macintosh OS (Mac) and the Microsoft Windows OS (PC). Analyzing the operating systems is a bit more difficult because both run similar

The Old Fools, By Philip Larkin

870 words - 3 pages Weddings, and High Windows. His use of vulgar expressions helps to emphasize the main concept in his work and develops a unique writing style of his own. Using his own poetic technique, Larkin conveys his discontentment with his existence and shows the psychological suffering he endured throughout his life. By analyzing Larkin’s poetry, a reader can appreciate the uniqueness of his style and understand the significance of the concepts conveyed