title: In-Depth Analysis of Computer Memory Acquisition Software for Forensic Purposes.
abstract: The comparison studies on random access memory (RAM) acquisition tools are either limited in metrics or the selected tools were designed to be executed in older operating systems. Therefore, this study evaluates widely used seven shareware or freeware/open source RAM acquisition forensic tools that are compatible to work with the latest 64-bit Windows operating systems. These tools' user interface capabilities, platform limitations, reporting capabilities, total execution time, shared and proprietary DLLs, modified registry keys, and invoked files during processing were compared. We observed that Windows Memory Reader and Belkasoft's Live Ram Capturer leaves the least fingerprints in memory when loaded. On the other hand, ProDiscover and FTK Imager perform poor in memory usage, processing time, DLL usage, and not-wanted artifacts introduced to the system. While Belkasoft's Live Ram Capturer is the fastest to obtain an image of the memory, Pro Discover takes the longest time to do the same job.
authors.affiliation: Department of Computer Science, Sam Houston State University, 1903 Ave I, Huntsville, TX, 77341.
authors.forename: Robert J
authors.initials: RJ
authors.lastname: McDown
authors.affiliation: Department of Computer Science, Sam Houston State University, 1903 Ave I, Huntsville, TX, 77341.
authors.forename: Cihan
authors.initials: C
authors.lastname: Varol
authors.affiliation: Department of Computer Science, Sam Houston State University, 1903 Ave I, Huntsville, TX, 77341.
authors.forename: Leonardo
authors.initials: L
authors.lastname: Carvajal
authors.affiliation: Department of Computer Science, Sam Houston State University, 1903 Ave I, Huntsville, TX, 77341.
authors.forename: Lei
authors.initials: L
authors.lastname: Chen
keywords: computer forensics; forensic science; forensic tools; live forensics; memory acquisition; volatile data