Tag
memory-forensics
- Sep 14, 2025 What Live Memory Acquisition Changes While It Reads Why the act of capturing physical memory alters the state being captured, which artifacts survive the read, and the ordering rules that follow from the perturbation. security
- May 21, 2023 Recovering Hidden Processes from a Physical Memory Image How the kernel links processes in several independent structures, why unlinking from one is insufficient, and the scan strategies that recover what the lists no longer contain. security