The VAD tree: A process-eye view of physical memory

Brendan Dolan-Gavitt

    Research output: Contribution to journalArticlepeer-review


    This paper describes the use of the Virtual Address Descriptor (VAD) tree structure in Windows memory dumps to help guide forensic analysis of Windows memory. We describe how to locate and parse the structure, and show its value in breaking up physical memory into more manageable and semantically meaningful units than can be obtained by simply walking the page directory for the process. Several tools to display information about the VAD tree and dump the memory regions it describes will also be presented.

    Original languageEnglish (US)
    Pages (from-to)62-64
    Number of pages3
    JournalDigital Investigation
    Issue numberSUPPL.
    StatePublished - Sep 2007


    • Anti-forensics
    • Digital forensics
    • Microsoft Windows
    • Virtual Address Descriptors
    • Volatile memory

    ASJC Scopus subject areas

    • Pathology and Forensic Medicine
    • Information Systems
    • Computer Science Applications
    • Medical Laboratory Technology
    • Law


    Dive into the research topics of 'The VAD tree: A process-eye view of physical memory'. Together they form a unique fingerprint.

    Cite this