Abstract: Traditional methods of memory acquisition focus on the persistent data of disk or hard disk in the attacked computers.However,as the growing use of encryption routines or rapidly increasing storage capabilities of hard drives,it is very difficult to get data in time with the original method that is meant for persistent data.So in the field of computer forensics,people start to change the data source and focus on the volatile information in RAM.This paper specifically describes the prevailing methods of memory acquisition and analysis and the process of memory forensics.It explains the characteristics of each method and gives the advantage and disadvantage of them.In the end,it concludes all these methods and gives some suggestions of the future of computer forensics.

Key words: cybercrime, computer forensics, memory forensics, memory acquisition, memory analysis, volatile information;process of memory forensics

摘要： 传统的计算机取证方法收集被攻击的计算机磁盘等能持久化保存数据的介质。但是随着磁盘存储能力的提升以及数据加密等技术的发展,使用原来针对硬盘的取证方法获取数据进行分析变得越来越困难。对计算机的取证开始采用其他数据源,包括计算机内存中易失性的信息。对Windows操作系统的主要内存获取、分析方法以及内存取证过程进行介绍,采用分析和对比的手段对每种方法的特点、优势和不足进行比较,得出比较结果并给出计算机犯罪内存取证领域未来需要研究的方向。

关键词: 网络犯罪, 计算机取证, 内存取证, 内存获取, 内存分析, 易失性信息, 内存取证过程

CLC Number: 

• TP393