DFRWS EU 2025 - Paper accepted

Our article on A Scenario-based Quality Assessment of Memory Acquisition Tools and its Investigative Implications was accepted at DFRWS EU 2025. The article presents a comparison of the ability of four memory acquisition tools to extract certain artifacts from a (Windows) memory dump. Additionally, the results were discussed in a legal context. The paper will be presented at the Digital Forensic Research Workshop (DFRWS) EU 2025 in March 2025 in Brno, Czech Republic.

Authors: Lisa Rzepka, Jenny Ottmann, Radina Stoykova, Felix Freiling and Harald Baier

Abstract: 
During digital forensic investigations volatile data from random-access memory (RAM) can provide crucial information such as access credentials or encryption keys. This data is usually obtained using software that copies contents of RAM to a memory dump file concurrently to normal system operation. It is well-known that this results in many inconsistencies in the copied data. Based on established quality criteria from the literature and on four typical investigative scenarios, we present and evaluate a methodology to assess the quality of memory acquisition tools in these scenarios. The methodology basically relates three factors: (1) the quality criteria of the memory dump, (2) the applied memory forensics analysis technique, and (3) its success in the given investigative scenario. We apply our methodology to four memory acquisition tools (from both the open source and the commercial community). It turns out that all tools have weaknesses but that their inconsistencies appear to be not as bad as anticipated. Another finding is that unstructured memory analysis methods are more robust against low quality (i.e., inconsistent) memory dumps than structured analysis methods. We provide the measurement dataset together with the tool by which it was acquired and also examine our findings in the context of legal and international standards for digital forensics in law enforcement investigations.