{"id":510,"date":"2016-03-29T09:05:31","date_gmt":"2016-03-29T09:05:31","guid":{"rendered":"https:\/\/www.digitalforensicscorp.com\/blog\/?p=510"},"modified":"2024-12-11T19:25:38","modified_gmt":"2024-12-11T19:25:38","slug":"pool-tag-quick-scanning-for-windows-memory-analysis","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/pool-tag-quick-scanning-for-windows-memory-analysis\/","title":{"rendered":"Pool tag quick scanning for windows memory analysis"},"content":{"rendered":"
A fresh article on memory forensics by\u00a0Joe T. Sylve,\u00a0Vico Marziale and\u00a0Golden G. Richard III is published. Here is the abstract:<\/p>\n
Pool tag scanning is a process commonly used in memory analysis in order to locate kernel object allocations, enabling investigators to discover evidence of artifacts that may have been freed or otherwise maliciously hidden from the operating system. The fastest current scanning techniques require an exhaustive search of physical memory, a process that has a linear time complexity over physical memory size. We propose a novel technique that we are calling \u201cpool tag quick scanning\u201d that is able to reduce the scanning space by 1\u20132 orders of magnitude, resulting in much faster discovery of targeted kernel data structures, while maintaining a high degree of accuracy.<\/em><\/p>\n