Volatile Memory Investigation

Abstract-

This research done to estimate the performance of different tools that acquire, analyze and recover the evidences of crime from volatile memory. Volatile memory stays for a very short period and that is why it is always tough to analyze such memory. It contains much valuable and confidential information such as passwords, usernames, running processes, etc. Acquiring, analyzing and recovering are the three major steps for memory forensics. All the tools investigated are not entirely fitted for a particular situation hence; the investigation needs to rely on many tools that can retrieve useful information from the evidences. It is important to know the usefulness of a tool before it is applied to solve a crime. Although most of the

To control the effects of such crimes digital forensics has gained popularity in recent years. In today’s world, the dependency on computers is growing widely. Government agencies and private companies are attempting to protect themselves from cyber attacks with digital defence techniques like encryption, firewalls and heuristic or signature scanning, etc. Meanwhile, the number of attacks that include sensitive military data canters, targeting power grids and stealing trade secrets from both private and public organizations continues to increase. the detection, response and reporting of these kinds of intrusions as well as other incidents involving computer systems, are critical for cyber security professionals Just like that, if the data taken from the organizations encrypted across the network, to determine which sensitive files were stolen and that won’t be recognized by traditional packet capture techniques. However, passwords and encrypted keys can often be recovered by memory forensics, or even the file’s plain-text contents before they were encrypted, providing information to understand the scope of an