Acquisition and analysis of volatile memory from android devices

Anderson

Betz

Burdach

Case, A. “De-anonymizing live CDs through physical memory analysis,” presented at the Blackhat DC Security Conference, Washington D.C., 2011.

Case, 2008, FACE: automated digital evidence discovery and correlation, Digital Investigation, 5, S65, 10.1016/j.diin.2008.05.008

Case, 2010, Treasure and tragedy in kmem_cache mining for live forensics investigation, Digital Investigation, 7, S41, 10.1016/j.diin.2010.05.006

Case, 2010, Dynamic recreation of kernel data structures for live forensics, Digital Investigation, 7, S32, 10.1016/j.diin.2010.05.005

Cozzie, A., et al. “Digging for data structures.” Proceeding of 8th symposium on operating system design and implementation (OSDI’08), 2008.

DFRWS

Dolan-Gavitt, B., et al. “Robust signatures for kernel data structures,” ACM conference on computer and communications security, 2009.

EWeek

Girault, 2010

Koll´ar, 2010

Kollar

Kramer

Lin, Z., et al. “Automatic reverse engineering of data structures from binary execution,” 17th annual network and distributed system security symposium (NDSS), 2010.

Lin, Z., et al. “SigGraph: brute force scanning of kernel data structure instances using graph-based signatures,” network and distributed systems security symposium (NDSS), 2011.

Slowinska, A., et al. “Howard: a dynamic excavator for reverse engineering data structures,” 18th annual network & distributed system security symposium (NDSS), 2011.

Thing, 2010

Volatility. https://www.volatilesystems.com/default/volatility; 2011.

Walters, 2006

Zalewski

Zinx