1 |
Matthieu Suiche, "Windows Hibernation File for Fun 'N' Profit," BlackHat USA, Aug. 2008.
|
2 |
James Butler, Justin Murdock, "Physical Memory Forensics for Files and Cache," Defcon 19, July. 2011.
|
3 |
Mark E. Russinovich, David Solomon,Alex Ionescu "Windows Internal 5th edition," Acorn, pp. 956-962, Jul. 2010.
|
4 |
Brendan Dolan-Gavitt, "The VAD tree: A process-eye view of physical memory," DIGITAL INVESTIGATION 4S, pp. 62-64, Sep. 2007.
|
5 |
Volatility procexedump,https://code.google.com/p/volatility/wiki/CommandReference23#procexedump
|
6 |
Rekall, http://www.rekall-forensic.com/docs/Manual/Plugins/Windows/PEDump.html
|
7 |
Mandiant Memoryze, https://www.mandiant.com/resources/download/memoryze
|