A scenario-based quality assessment of memory acquisition tools and its investigative implications

Rzepka L, Ottmann J, Stoykova R, Freiling F, Baier H (2025)

Publication Type: Journal article

Publication year: 2025

Journal

Forensic Science International: Digital Investigation Elsevier

Book Volume: 52

Article Number: 301868

DOI: 10.1016/j.fsidi.2025.301868

Abstract

During digital forensic investigations volatile data from random-access memory (RAM) can provide crucial information such as access credentials or encryption keys. This data is usually obtained using software that copies contents of RAM to a memory dump file concurrently to normal system operation. It is well-known that this results in many inconsistencies in the copied data. Based on established quality criteria from the literature and on four typical investigative scenarios, we present and evaluate a methodology to assess the quality of memory acquisition tools in these scenarios. The methodology basically relates three factors: (1) the quality criteria of the memory dump, (2) the applied memory forensics analysis technique, and (3) its success in the given investigative scenario. We apply our methodology to four memory acquisition tools (from both the open source and the commercial community). It turns out that all tools have weaknesses but that their inconsistencies appear to be not as bad as anticipated. Another finding is that unstructured memory analysis methods are more robust against low quality (i.e., inconsistent) memory dumps than structured analysis methods. We provide the measurement dataset together with the tool by which it was acquired and also examine our findings in the context of legal and international standards for digital forensics in law enforcement investigations.

Authors with CRIS profile

Jenny Ottmann Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Felix Freiling Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Involved external institutions

Universität der Bundeswehr München DE Germany (DE) University of Groningen / Rijksuniversiteit Groningen NL Netherlands (NL)

How to cite

APA:

Rzepka, L., Ottmann, J., Stoykova, R., Freiling, F., & Baier, H. (2025). A scenario-based quality assessment of memory acquisition tools and its investigative implications. Forensic Science International: Digital Investigation, 52. https://doi.org/10.1016/j.fsidi.2025.301868

MLA:

Rzepka, Lisa, et al. "A scenario-based quality assessment of memory acquisition tools and its investigative implications." Forensic Science International: Digital Investigation 52 (2025).

BibTeX: Download