On the extraction of forensically relevant information from physical memory

Most of the effort in today's digital investigations centres on the data collection and analysis of existing information from the hard disks of computer systems. Little has been done on the level of information that can be recovered from only the computer system memory (RAM) while the application is still running. In this paper, we present the results of an investigation into the extraction of forensically relevant information from physical memory. We also present our findings of the most commonly used applications on a windows system. The information extracted from physical memory relates to what the user was doing at the time of the capture, and before the capture, of the physical memory evidence.