The VAD tree: A process-eye view of physical memory

Brendan Dolan-Gavitt

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    This paper describes the use of the Virtual Address Descriptor (VAD) tree structure in Windows memory dumps to help guide forensic analysis of Windows memory. We describe how to locate and parse the structure, and show its value in breaking up physical memory into more manageable and semantically meaningful units than can be obtained by simply walking the page directory for the process. Several tools to display information about the VAD tree and dump the memory regions it describes will also be presented.

    Original languageEnglish (US)
    Title of host publicationDFRWS 2007 Annual Conference
    DOIs
    StatePublished - 2007
    Event7th Annual Digital Forensic Research Workshop, DFRWS 2007 - Pittsburgh, PA, United States
    Duration: Aug 13 2007Aug 15 2007

    Other

    Other7th Annual Digital Forensic Research Workshop, DFRWS 2007
    CountryUnited States
    CityPittsburgh, PA
    Period8/13/078/15/07

    Keywords

    • Anti-forensics
    • Digital forensics
    • Microsoft Windows
    • Virtual Address Descriptors
    • Volatile memory

    ASJC Scopus subject areas

    • Information Systems

    Fingerprint Dive into the research topics of 'The VAD tree: A process-eye view of physical memory'. Together they form a unique fingerprint.

    Cite this