IMF 2026 - Two Papers accepted

Our articles on "Frankenstein’s RAM: A Simulation Framework for Evaluating Memory Forensic Acquisition Strategies" and "Process Priority in Memory Acquisition: Evaluating Its Influence on Memory Dump Consistency" were accepted at IMF 2026. The papers will be presented at the "15th International Conference on IT Security Incident Management & IT Forensics 2026" in September 2026 in Bonn, Germany.

Frankenstein’s RAM: A Simulation Framework for Evaluating Memory Forensic Acquisition Strategies

Authors: Lisa Rzepka, Jan Gruber, Felix Freiling and Harald Baier

Abstract:
Memory forensics relies on acquiring a faithful copy of RAM, yet software-based acquisition is inherently non-atomic: the operating system keeps modifying memory while pages are read, producing inconsistencies known as page smear. Prior work formalized quality criteria and measured such inconsistencies, but how the acquisition strategy, i.e., page order and transfer rate, affects image quality remains unexplored, and no public framework decouples strategy from the acquisition channel.
We present Frankenstein, a simulation-based framework that synthesizes a memory dump from a time series of atomic, hypervisor-level ground-truth snapshots under a configurable traversal strategy and bandwidth model. We implement seven strategy–bandwidth combinations and evaluate them across three workloads via Hamming distance and semantic analysis. We find the acquisition strategy considerably affects quality, but, interestingly, no traversal minimizes byte-level distance and structural-semantic inconsistencies at the same time, since pages dominating byte-level change (user mappings, page cache) compete with pointer-rich kernel objects (slab, kernel pages) for the most timely acquisition. We therefore propose novel page-category priority orderings—a structural focus (slab and kernel pages first) and a volatile focus (user and page-cache pages first)—cutting semantic inconsistencies and Hamming distance respectively.

Process Priority in Memory Acquisition: Evaluating Its Influence on Memory Dump Consistency

Authors: Mike Oswald, Lisa Rzepka and Harald Baier

Abstract:
During software-based memory acquisition, competing processes can reduce memory dump reliability by interfering with memor capture. This can produce structural inconsistencies, such as discrepancies in Virtual Memory Area (VMA) metadata on Linux, as well as temporal inconsistencies, including violations of causal ordering. Although previous work has examined the occurrence and characteristics of such inconsistencies, the influence of user side acquisition-process priority on structural and temporal dump consistency has not been systematically evaluated under different system-load conditions.
This paper presents an experimental analysis of the effects of acquisition priority and system load on Linux memory-dump consistency. Our primary Linux-hosted evaluation comprises 180 memory dumps covering six acquisition priority classes and three workload levels, supplemented by Windows Subsystem for Linux (WSL)-hosted comparisons. Our results show that the effects of system load and acquisition priority depend on the experimental configuration. The strongest workload effects occurred in the primary experiments, but weakened with fixed pivot threads and were not entirely reproduced in WSL data. Acquisition priority became relevant under elevated contention. Most forensic artifacts remained recoverable, with isolated failures for structured extraction under adverse acquisition conditions. Overall, memory-dump consistency is shaped by the interaction between runtime conditions, acquisition priority, and the execution environment.