Abstract

Traditional computer forensics has mainly focused on uncovering evidence from non-volatile storage (e.g., disks). However, investigators have increasingly realized the value of evidence in a computer's memory image, which contains "live" evidence left by program execution, such as recent chat contents, logins, and photos viewed. In this talk, I will report results from our memory forensics research enabled by probabilistic inference and binary program analysis. First, I will present a method that discovers instances of a program data structure in a memory image, based on probabilistic inference on a set of Boolean constraints generated from data structure definitions and memory contents. Second, I will present a system that enables intuitive rendering of the discovered data structure instances in human-understandable format, by reusing relevant code in the application binary as rendering functions. Evaluation results with real-world programs and in-memory data will be presented to demonstrate the effectiveness of our techniques.