{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T13:36:08Z","timestamp":1782912968791,"version":"3.54.5"},"publisher-location":"Berlin, Heidelberg","reference-count":16,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642155055","type":"print"},{"value":"9783642155062","type":"electronic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2010]]},"DOI":"10.1007\/978-3-642-15506-2_13","type":"book-chapter","created":{"date-parts":[[2010,11,26]],"date-time":"2010-11-26T12:20:33Z","timestamp":1290774033000},"page":"185-194","source":"Crossref","is-referenced-by-count":6,"title":["Identifying Volatile Data from Multiple Memory Dumps in Live Forensics"],"prefix":"10.1007","author":[{"given":"Frank","family":"Law","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Chan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siu-Ming","family":"Yiu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Benjamin","family":"Tang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pierre","family":"Lai","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kam-Pui","family":"Chow","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ricci","family":"Ieong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael","family":"Kwan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wing-Kai","family":"Hon","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lucas","family":"Hui","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","reference":[{"key":"13_CR1","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1016\/j.diin.2007.06.010","volume":"125","author":"A. Arasteh","year":"2007","unstructured":"A. Arasteh and M. Debbabi, Forensic memory analysis: From stack and code to execution history, Digital Investigation, vol. 4(S), pp. S114\u2013S125, 2007.","journal-title":"Digital Investigation"},{"key":"13_CR2","doi-asserted-by":"crossref","unstructured":"G. Balakrishnan and T. Reps, Analyzing memory accesses in x86 executables, Proceedings of the Thirteenth International Conference on Compiler Construction, pp. 5\u201323, 2004.","DOI":"10.1007\/978-3-540-24723-4_2"},{"key":"13_CR3","unstructured":"Bugcheck, GREPEXEC: Grepping executive objects from pool memory (www.uninformed.org\/?v=4&a=2&t=pdf), 2006."},{"key":"13_CR4","unstructured":"M. Burdach, An introduction to Windows memory forensics (forens ic.seccure.net\/pdf\/introduction_to_windows_memory_forensic.pdf), 2005."},{"key":"13_CR5","unstructured":"M. Burdach, Digital forensics of the physical memory (forensic.sec cure.net\/pdf\/mburdach_digital_forensics_of_physical_memory.pdf), 2005."},{"key":"13_CR6","unstructured":"M. Burdach, Windows Memory Forensic Toolkit (forensic.seccure .net), 2007."},{"issue":"1","key":"13_CR7","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1016\/j.diin.2003.12.001","volume":"1","author":"B. Carrier","year":"2004","unstructured":"B. Carrier and J. Grand, A hardware-based memory acquisition procedure for digital investigations, Digital Investigation, vol. 1(1), pp. 50\u201360, 2004.","journal-title":"Digital Investigation"},{"key":"13_CR8","doi-asserted-by":"crossref","unstructured":"K. Chow, F. Law, M. Kwan and P. Lai, Consistency issues in live systems forensics, Proceedings of the International Workshop on Forensics for Future Generation Communication Environments, pp. 136\u2013140, 2007.","DOI":"10.1109\/FGCN.2007.93"},{"key":"13_CR9","volume-title":"Forensic Discovery","author":"D. Farmer","year":"2005","unstructured":"D. Farmer and W. Venema, Forensic Discovery, Addison-Wesley, New York, 2005."},{"key":"13_CR10","unstructured":"G. Garcia, Forensic physical memory analysis: Overview of tools and techniques, Telecommunications Software and Multimedia Laboratory, Helsinki University of Technology, Helsinki, Finland (www.tml .tkk.fi\/Publications\/C\/25\/papers\/Limongarcia_final.pdf), 2007."},{"issue":"3-4","key":"13_CR11","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1016\/j.diin.2008.02.001","volume":"4","author":"E. Huebner","year":"2007","unstructured":"E. Huebner, D. Bem, F. Henskens and M. Wallis, Persistent systems techniques in forensic acquisition of memory, Digital Investigation, vol. 4(3-4), pp. 129\u2013137, 2007.","journal-title":"Digital Investigation"},{"issue":"4","key":"13_CR12","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1016\/j.diin.2006.10.001","volume":"3","author":"N. Petroni","year":"2006","unstructured":"N. Petroni, A. Walters, T. Fraser and W. Arbaugh, FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory, Digital Investigation, vol. 3(4), pp. 197\u2013210, 2006.","journal-title":"Digital Investigation"},{"key":"13_CR13","doi-asserted-by":"crossref","unstructured":"T. Reps and G. Balakrishnan, Improved memory-access analysis for x86 executables, Proceedings of the Seventeenth International Conference on Compiler Construction, pp. 16\u201335, 2008.","DOI":"10.1007\/978-3-540-78791-4_2"},{"issue":"S1","key":"13_CR14","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1016\/j.diin.2006.06.010","volume":"3","author":"A. Schuster","year":"2006","unstructured":"A. Schuster, Searching for processes and threads in Microsoft Windows memory dumps, Digital Investigation, vol. 3(S1), pp. S10\u2013S16, 2006.","journal-title":"Digital Investigation"},{"issue":"3","key":"13_CR15","doi-asserted-by":"publisher","first-page":"65","DOI":"10.1145\/1368506.1368516","volume":"42","author":"I. Sutherland","year":"2008","unstructured":"I. Sutherland, J. Evans, T. Tryfonas and A. Blyth, Acquiring volatile operating system data: Tools and techniques, ACM SIGOPS Operating Systems Review, vol. 42(3), pp. 65\u201373, 2008.","journal-title":"ACM SIGOPS Operating Systems Review"},{"issue":"S","key":"13_CR16","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1016\/j.diin.2008.05.014","volume":"5","author":"R. Baar van","year":"2008","unstructured":"R. van Baar, W. Alink and A. van Ballegooij, Forensic memory analysis: Files mapped in memory, Digital Investigation, vol. 5(S), pp. S52\u2013S57, 2008.","journal-title":"Digital Investigation"}],"container-title":["IFIP Advances in Information and Communication Technology","Advances in Digital Forensics VI"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-15506-2_13.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T06:51:45Z","timestamp":1740725505000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-15506-2_13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010]]},"ISBN":["9783642155055","9783642155062"],"references-count":16,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-15506-2_13","relation":{},"ISSN":["1868-4238","1861-2288"],"issn-type":[{"value":"1868-4238","type":"print"},{"value":"1861-2288","type":"electronic"}],"subject":[],"published":{"date-parts":[[2010]]}}}