Memory Forensics: Tools Comparison

This research done to estimate the performance of different tools that acquire, analyze and recover the evidences of crime from volatile memory. Volatile memory stays for a very short period and that is why it is always tough to analyze such memory. It contains much valuable and confidential information such as passwords, usernames, running processes, etc. Acquiring, analyzing and recovering are the three major steps for memory forensics. All the tools investigated are not entirely fitted for a particular situation hence, the investigation needs to rely on many tools that can retrieve useful information from the evidences. It is important to know the usefulness of a tool before it is applied to solve a crime. Although most of the tools are successful in providing reasonable evidence, no single tool is sufficient to complete the investigation.