Automated RAM analysis mechanism for windows operating system for digital investigation

Analysing memory can be a daunting task. This is especially apparent for a digital forensic investigator that may not have the technical expertise to perform the memory analysis. A solution to this is a one-click tool that can scan and analyze a memory image and produce useful information in a digital forensic investigation. Such a tool can be created as a plug-in for the well-known investigative tools. This study, therefore, developed a tool that can be used as a plug-in for Autopsy (or any python-based forensic tool). The developed tool is evaluated based on the existing metrics of tool evaluation, and the result shows the applicability of the tool for memory analysis. By automating the analysis of a memory image, this study asserts that the number of mistakes made during an investigation can be reduced. Furthermore, the study asserts that the time and task complexity required for a memory forensics can be reduced by the automated process.