Quick Revision Sheet - Lecture 1

CST3510 Memory Analysis — Week 1

🔴 Commands / technical terms I would highlight in your notes

Week 1

Concepts to highlight:

• 
  RAM

• 
  Volatile memory

• 
  Process

• 
  Virtual address

• 
  Physical address

• 
  Page

• 
  Frame

• 
  Page table

• 
  Page fault

• 
  Memory acquisition

• 
  Memory image/dump

• 
  Hashing

• 
  Record

• 
  Field

• 
  Pointer

• 
  Reconstruction

• CMDSCAN

1. What is RAM?

RAM = Random Access Memory

• Main working memory of a computer.

• Temporarily stores:

  • Program instructions

  • Working data

  • Operating-system information

  • Current system state

• RAM is volatile → contents normally disappear when power is removed.

• Unlike storage, RAM represents the current/active state of the computer.

2. What can memory forensics reveal?

Memory can provide evidence about:

• Processes → what was running

• Network connections → what the computer was communicating with

• Users/sessions → which user/security context was involved

• Commands/content → commands, clipboard data, cached/decrypted information

• Loaded modules/drivers

• Files/resources

Important: Finding an artefact does not automatically prove malicious activity.

3. Memory Forensics vs Disk Forensics

Key idea: Use memory and storage together because neither gives a complete picture.

⭐ 4. Live system vs shutdown

If the computer stays ON:

• RAM continues changing.

• Processes/connections can change.

• Some volatile evidence may be overwritten.

If the computer is SHUT DOWN:

• Running processes terminate.

• Connections disappear.

• In-use data may become unavailable.

• Persistent state may also change.

⭐ Exam point

There is no perfect option.

The investigator must consider:

• Evidence needed

• Operational risk

• Legal/organisational authority

• Circumstances of the incident

5. Processes

A program is stored executable code.

When the OS runs it → it becomes a process.

A process has:

• Its own identity

• Virtual address space

• Resources

• Execution context

One program can create multiple processes.

Forensics

A file on disk can show that the program existed.

Memory can show that a running instance existed at the time of capture.

Important: A familiar process name does not automatically mean the process is legitimate.

⭐ 6. Virtual memory

Each process has its own virtual address space.

This means:

The same virtual address can exist in different processes but refer to different physical memory.

Remember:

Virtual address → Page → Physical frame → RAM

7. Pages and frames

• Virtual memory is divided into pages.

• Physical RAM is divided into frames.

• Pages can be mapped to different physical frames.

• Neighbouring virtual pages do not necessarily occupy neighbouring physical frames.

4 KiB is a common page size.

⭐ 8. Page tables

Page tables contain the mappings between:

Virtual pages → Physical frames

They allow the system to determine where a virtual address actually exists in physical RAM.

Important terms

Resident page

• Currently has a physical frame in RAM.

Non-resident page

• Currently has no usable physical frame in RAM.

⚠ Non-resident does NOT mean:

• Deleted

• Invalid

• Never existed

9. Page fault

A page fault happens when a memory access cannot currently be satisfied.

The OS can:

1. Load existing content

2. Create/allocate a page

3. Reject the access

⭐ Important

A page fault is not automatically evidence of malware or failure. It is a normal memory-management mechanism.

⭐ 10. Memory acquisition

Memory acquisition = copying accessible physical-memory contents into a file/image for later investigation.

RAM → Memory acquisition → Memory image/dump

A RAM image contains physical-memory bytes, not automatically:

• Complete virtual address spaces

• Clearly labelled processes

• Ready-made evidence

• Final investigative conclusions

The investigator must reconstruct this information during analysis.

⭐ 11. Live memory acquisition

When acquiring RAM from a running system:

System continues running → memory continues changing → acquisition occurs over time

Therefore, a live memory dump is not necessarily a perfect snapshot at one exact moment.

Different regions can represent slightly different points in time.

12. Hashing

Hashing helps demonstrate integrity.

For a stable source:

Matching hash → acquired file remains consistent with the verified file.

For live RAM:

Matching hash → the saved dump has not changed since it was hashed.

⚠ A hash does not prove that the live acquisition captured everything or was instantaneous.

⭐ 13. Raw memory → forensic evidence

A memory image initially contains:

• Addresses

• Bytes

• Printable text

It does not automatically tell you:

"This is a malicious process."

You need:

Raw bytes → Recognise structure → Apply context → Identify possible artefact

Memory forensics therefore involves reconstruction.

14. Records, fields and pointers

Record

An organised collection of related values representing an entity/state.

Field

One value within a record.

Pointer/link

A stored reference connecting one record to another.

Pointers can help reconstruct:

• Parent/child relationships

• Ownership

• Resources

• Connections between objects

⭐ 15. Two recovery approaches

Follow system links

Uses existing relationships between records.

Advantage: preserves context.

Limitation: may miss records that are no longer reachable.

Scan physical memory

Searches memory for record-like structures.

Advantage: may find residual/unlinked data.

Limitation: candidates can be stale, incomplete or false.

Exam point

A difference between these methods is something to investigate, not automatic proof of concealment.

⭐ Week 1 core revision chain

Running computer

↓

RAM / volatile state

↓

Processes + OS structures + network + user context

↓

Virtual memory

↓

Pages → Page tables → Physical frames

↓

Memory acquisition

↓

Memory image

↓

Reconstruction

↓

Structured forensic artefacts

↓

Interpretation + corroboration

Week 1 commands to highlight

The Week 1 slides are primarily conceptual, so there aren't many commands to memorise from this week.

One important example appears in the reconstruction material:

CMDSCAN

The slides show it recovering command-line evidence such as:

net use r: \\172.16.150.10\ITShare
copy r:\mdd.exe

Treat CMDSCAN as a tool/plugin name worth highlighting, but the bigger Week 1 concept is understanding how raw memory becomes evidence.