Memory Forensics

Haider M. al-Khateeb and Carsten Maple explain how to harvest Windows Credentials from volatile storage.

In forensic investigations, it is a challenge to recover objective evidence through means of research then attribute the relevant artefacts to an individual. In this series of articles and within the context of volatility memory forensic investigation, we set our scope on recovering user credentials which could be essential not only to unlock hidden and/or encrypted data but also to identify recent users and analyse their unique characteristics. These can then be used to establish a connection between digital evidence and a user of the system. That being said, the article also aims to critically discuss the significance of memory forensics, in addition to demonstrating tools and techniques used to carry out the process of memory acquisition and analysis.