Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Digital Forensics and Incident Response

You're reading from   Digital Forensics and Incident Response A practical guide to deploying digital forensic techniques in response to cyber security incidents

Arrow left icon
Product type Paperback
Published in Jul 2017
Publisher Packt
ISBN-13 9781787288683
Length 324 pages
Edition 1st Edition
Concepts
Arrow right icon
Author (1):
Arrow left icon
Gerard Johansen Gerard Johansen
Author Profile Icon Gerard Johansen
Gerard Johansen
Arrow right icon
View More author details
Toc

Memory evidence overview


When discussing analyzing the memory of a system, there are two terms that are used interchangeably. The first is RAM. RAM is the portion of the computer internal systems where the operating system places data utilized by applications and the system hardware while that application or hardware is in use. What makes RAM different from storage is the volatile nature of the data. Often, if the system is shut off, the data will be lost.

There is a good deal of data contained within RAM at the time a system is running that is valuable in an incident investigation. These include the following:

  • Running processes
  • Loaded Dynamic Link Libraries(DLL)
  • Open Registry Keys
  • Network connections
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image