Analyzing Windows Memory Essay

Submitted By buddylee1998
Words: 1730
Pages: 7
Open Document
Analyzing Windows Memory
CFDI 270

Overview Network forensics follows numerous paths due to the astronomical differences in all of the various networks around the world. But in any investigation memory analysis may play a critical role. We will cover the basic processing of memory and its analysis in the Windows operating system.
Delving Into Windows Network investigation cases will rarely follow a rote path. However, most investigations have a few typical steps that are taken. One of the first steps is to acquire the memory if we are doing a live analysis. We can glean a myriad of invaluable information from a computer’s memory. This information may include hidden and running processes, when these processes were started and by whom, and what these specific processes were doing. Terminated objects may even be found in memory days after they were killed. The memory also will have the state of active network connections (Burdach). Windows translates addresses in a three stage procedure generally. Every process on a Windows system maintains a DirectoryTableBase (DTB). The value of the DTB is stored in the CR3 register when the process is running. This value contains the base address of the table of Page Directory Entries (PDE) for that process. Every virtual address that is translated, has a PDE specified using some of the bits from the original virtual address. The PDE is used to find the base address of a specific page of Page Table Entries (PTE). This specific PTE is designated using this base address and some more bits from the original virtual address. The PTE will now point to the base address of the page in physical memory where the data is stored. The actual data address in physical memory is the base address of this page plus the remaining bits from the original virtual address (Petroni). The first byte of the PDE or PTE is the validity byte. If the byte is 0 it is invalid. If the byte is 1 it is valid.
Every PDE or PTE, including invalid entries, fits into one of six categories. The categories are Page file, Zero, Demand Zero, Prototype, Transition, and Unknown. The memory has a finite amount of data that it can retain. Once this data limit is reached paging files are stored on the disk. If a PDE or PTE is invalid and has byte 10, Prototype, and byte 11, Transition, as 0 the entry points to one of these paging files on the disk (Petroni). It is a Demand Zero when the page file number, bits 1-4, and the page file offset, bits 12-31, are zero. These pages can be ignored as they only represent a zero. When the t bit is 1, but the p bit is 0 the page is in Transition. This means that page has been modified but not yet written to disk. The page in this case can still be retrieved by an examiner in this status due to being active in memory (Petroni). The prototype bit has no bearing on PDE’s, but if it is set in a PTE then it is a pointer to a prototype page table entry. When the P bit is set in the PTE the T bit is part of the prototype index number (Petroni). A prototype page is similar to a symbolic link for a shared file. This way the system only needs to update the prototype PTE instead of every process utilizing the true PTE. To locate the virtual address of a prototype PTE one multiplies the index number in the invalid PTE by the size of the PTE. This product is then added to the start of the system’s paged area (Petroni). When a page is in Zero state the operating system has dedicated a page of physical memory for a process, but the page has not yet been accessed (Petroni). “Windows memory analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a memory image,” (Schuster). Due to Windows caching large amounts of file data in memory we need to ensure we take invalid, mapped-file data into account. Memory is divided into
Show More

Related Documents: Analyzing Windows Memory Essay

To Kill A Mockingbird Memory Analysis

breaking his arm; Scout’s memory is incredible because she can remember the smallest of details from her accounts as a child, which implies that her memory does not hinder the story. Scout Finch’s memory is amazing, this can be inferred from Harper Lee’s descriptive word choice. “I went to the backyard and found Jem plugging away at a tin can, which seemed stupid to me with all the blue jays around” (Lee 211). The author used vivid language to display Scout’s incredible memory. Words such as tin can…

Words 614 - Pages 3

Essay on USAA System

Services Automobile Association (USAA), the key usage of the operating system is to read and write information and store data. The main programs used are Microsoft Windows 7. Applications include Microsoft Word, Excel and Power point. This is not surprising as it is said that 95 percent of business use windows of some kind. Within Windows, a user will see applications such as Microsoft (MI) Office, MS Word, MS Excel, MS Access and MS Power point. These featured programs allow the user to create professional…

Words 1458 - Pages 6

'Patriotism In Wiesel's, Night'

for it to be considered war literature. The portrayal of patriotism in a war literature enables readers to realize that there are human beings who are willing to risk their lives for their country: “Outside, there’re people walking around by the windows like it’s no big deal. People who have no idea where Fallujah is…” (Klay 12). Here, Klay is also trying to inform the readers that…

Words 1607 - Pages 7

Willie S Homework Final Edit Essay

are very significant depending on the case. However, this paper give precedence to data sources used to acquire evidence for network intrusions, malware installations, and insider file deletions. These three events direct the arrangement to the analyzing of data presented. In addition, the paper also covers what communication is preferred, and the practicality of that data. Primary emphasis is data brought together from sources such as Live System Data, Intrusion Detection System, Network Intrusion…

Words 1181 - Pages 5

Economics: Variable and Stata Essays

prompts in the window, and then click Install. This should only take a few seconds. When asked, you do not need to re-start your computer at this time. Next you will need to install Stata. Open up the program you just downloaded: Stata10.exe. Click on OK to being a Harvard affiliate, and the install should begin automatically. After about 1 minute, another window will pop open. Click Next three times, and the installation will continue. After about 30 seconds, a third prompt window will open up…

Words 2360 - Pages 10

Nt1330 Unit 3 Lab Report

used for calculating the high response time which will be done manually browser and gives us the analysis about the correlation. We have a look at garbage collection so that we can scan the entire heap and sees the objects which are still using the memory. If we find the high response time then there will high spike in the graph and there will be dump in the graph. Lock weight is used for the admin to configure the servers. In dyna trace, we can investigate the potential web performance and build more…

Words 785 - Pages 4

My Writing Journey

Other Stories, in-class activities, working with Columbus students, and a poem, which emulates Kwame Alexander’s “as in:” style of poetry. Overview of Lesson Plan This lesson focuses on narrative writing. After analyzing specific literary elements (which Lowry uses to convey the memories that the Giver gives to the Receiver), and after students participate in various activities (that demonstrate the methods of story-telling and the importance of sequence), students will be able to produce their own…

Words 1904 - Pages 8

MKT 452 Exam 1 Essay

A limited period of time during which the characteristics of a market and distinctive competencies of a firm fit together well and reduce the risks of seizing particular market opportunity is called _____. a. a strategic window b. a SWOT c. external scanning d. environmental factors e. audit scanning 10. Which of the following does NOT fit into the sports marketing research process? a. defining the problem b. choosing the research design c. identifying…

Words 1028 - Pages 5

Essay on Strength Quest

own personality while starring at myself in the mirror. If there was a sentence to explain “Chrissy” this would be it, or at least a very good candidate when summarizing my number one strength. After completing my StrengthQuest survey online and analyzing my results with the three people who…

Words 1695 - Pages 7

Essay Reversing Technics

outside of the confines of the program you want to crack. Getting your bearings is, in these cases, very important. One of the handiest utilities is the memory dump tool -it tells you where all the device drivers and TSR are loaded, in which memory locations the program you are cracking dwells, how much memory is left and what the next program load point is. The tools you use should report on the following: - the contents of interrupt vectors - the state of the…

Words 3427 - Pages 14