{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,16]],"date-time":"2026-09-16T02:14:52Z","timestamp":1789524892140,"version":"build-2803163510"},"reference-count":38,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2023,12,12]],"date-time":"2023-12-12T00:00:00Z","timestamp":1702339200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) as part of the Research and Training Group 2475 \u201cCybercrime and Forensic Computin\u201d","award":["393541319\/GRK2475\/1-2019"],"award-info":[{"award-number":["393541319\/GRK2475\/1-2019"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2024,2,29]]},"abstract":"<jats:p>Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads).<\/jats:p>","DOI":"10.1145\/3628600","type":"journal-article","created":{"date-parts":[[2023,10,20]],"date-time":"2023-10-20T21:45:55Z","timestamp":1697838355000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["An Experimental Assessment of Inconsistencies in Memory Forensics"],"prefix":"10.1145","volume":"27","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1090-0566","authenticated-orcid":false,"given":"Jenny","family":"Ottmann","sequence":"first","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5261-4600","authenticated-orcid":false,"given":"Frank","family":"Breitinger","sequence":"additional","affiliation":[{"name":"University of Lausanne, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8279-8401","authenticated-orcid":false,"given":"Felix","family":"Freiling","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,12,12]]},"reference":[{"key":"e_1_3_3_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/153724.153741"},{"key":"e_1_3_3_3_2","volume-title":"Understanding the Linux Kernel: From I\/O Ports to Process Management","author":"Bovet Daniel P.","year":"2005","unstructured":"Daniel P. Bovet and Marco Cesati. 2005. Understanding the Linux Kernel: From I\/O Ports to Process Management. O\u2019Reilly Media."},{"key":"e_1_3_3_4_2","volume-title":"Proceedings of the 11th Australian Digital Forensics Conference","author":"Campbell William","year":"2013","unstructured":"William Campbell. 2013. Volatile memory acquisition tools\u2014A comparison across taint and correctness. In Proceedings of the 11th Australian Digital Forensics Conference."},{"key":"e_1_3_3_5_2","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1016\/j.diin.2016.12.004","article-title":"Memory forensics: The path forward","volume":"20","author":"Case Andrew","year":"2017","unstructured":"Andrew Case and Golden G. Richard III. 2017. Memory forensics: The path forward. Digital Investigation 20 (2017), 23\u201333.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_6_2","volume-title":"Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet","author":"Casey Eoghan","year":"2011","unstructured":"Eoghan Casey. 2011. Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet (3rd ed.). Academic Press. http:\/\/www.elsevierdirect.com\/product.jsp?isbn=9780123742681"},{"key":"e_1_3_3_7_2","doi-asserted-by":"publisher","DOI":"10.1007\/s004460050049"},{"key":"e_1_3_3_8_2","first-page":"444","volume-title":"Proceedings of the 7th IEEE\/ACIS International Conference on Computer and Information Science (ICIS\u201908)","author":"Chu Chunbo","year":"2008","unstructured":"Chunbo Chu and Monica Brockmeyer. 2008. Predicate detection modality and semantics in three partially synchronous models. In Proceedings of the 7th IEEE\/ACIS International Conference on Computer and Information Science (ICIS\u201908). IEEE, Los Alamitos, CA, 444\u2013450. DOI:10.1109\/ICIS.2008.95"},{"key":"e_1_3_3_9_2","doi-asserted-by":"crossref","first-page":"167","DOI":"10.1145\/122759.122774","volume-title":"Proceedings of the ACM\/ONR Workshop on Parallel and Distributed Debugging.","author":"Cooper Robert","year":"1991","unstructured":"Robert Cooper and Keith Marzullo. 1991. Consistent detection of global predicates. In Proceedings of the ACM\/ONR Workshop on Parallel and Distributed Debugging. ACM, New York, NY, 167\u2013174. DOI:10.1145\/122759.122774"},{"key":"e_1_3_3_10_2","first-page":"236","volume-title":"Proceedings of the 8th ACM Conference on Data and Application Security and Privacy (CODASPY\u201918)","author":"Cox Guilherme","year":"2018","unstructured":"Guilherme Cox, Zi Yan, Abhishek Bhattacharjee, and Vinod Ganapathy. 2018. Secure, consistent, and high-performance memory snapshotting. In Proceedings of the 8th ACM Conference on Data and Application Security and Privacy (CODASPY\u201918). ACM, New York, NY, 236\u2013247. DOI:10.1145\/3176258.3176325"},{"key":"e_1_3_3_11_2","unstructured":"Volatility Foundation. 2009. Volatility Framework\u2014Volatile Memory Extraction Utility Framework. Retrieved October 30 2023 from https:\/\/github.com\/volatilityfoundation\/volatility; Commit:a438e768194a9e05eb4d9ee9338 b881c0fa25937."},{"key":"e_1_3_3_12_2","unstructured":"Volatility Foundation. 2019. Volatility 3: The Volatile Memory Extraction Framework. Retrieved October 30 2023 from https:\/\/github.com\/volatilityfoundation\/volatility3; Commit:f8506862c4d92422a5e8927f70778f7faf69faf9."},{"key":"e_1_3_3_13_2","first-page":"94","volume-title":"Proceedings of the 19th IEEE Symposium on Reliable Distributed Systems (SRDS\u201900)","author":"G\u00e4rtner Felix C.","year":"2000","unstructured":"Felix C. G\u00e4rtner and Sven Kloppenburg. 2000. Consistent detection of global predicates under a weak fault assumption. In Proceedings of the 19th IEEE Symposium on Reliable Distributed Systems (SRDS\u201900). IEEE, Los Alamitos, CA, 94\u2013103. DOI:10.1109\/RELDI.2000.885397"},{"key":"e_1_3_3_14_2","unstructured":"Google. 2013. Rekall Memory Forensic Framework. Retrieved October 30 2023 from https:\/\/github.com\/google\/rekall; Commit:55d1925f2df9759a989b35271b4fa48fc54a1c86."},{"key":"e_1_3_3_15_2","first-page":"S94\u2013S105","article-title":"Availability of datasets for digital forensics\u2014And what is missing","volume":"22","author":"Grajeda Cinthya","year":"2017","unstructured":"Cinthya Grajeda, Frank Breitinger, and Ibrahim Baggili. 2017. Availability of datasets for digital forensics\u2014And what is missing. Digital Investigation 22 (2017), S94\u2013S105.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_16_2","first-page":"S1\u2013S10","article-title":"Evaluating atomicity, and integrity of correct memory acquisition methods","volume":"16","author":"Gruhn Michael","year":"2016","unstructured":"Michael Gruhn and Felix C. Freiling. 2016. Evaluating atomicity, and integrity of correct memory acquisition methods. Digital Investigation 16 (2016), S1\u2013S10.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/78969.78972"},{"key":"e_1_3_3_18_2","doi-asserted-by":"crossref","first-page":"302","DOI":"10.1109\/ICDCS.1990.89297","volume-title":"Proceedings of the 10th International Conference on Distributed Computing Systems (ICDCS\u201990)","author":"Hutto Phillip W.","year":"1990","unstructured":"Phillip W. Hutto and Mustaque Ahamad. 1990. Slow memory: Weakening consistency to enhance concurrency in distributed shared memories. In Proceedings of the 10th International Conference on Distributed Computing Systems (ICDCS\u201990). IEEE, Los Alamitos, CA, 302\u2013309. DOI:10.1109\/ICDCS.1990.89297"},{"key":"e_1_3_3_19_2","first-page":"S42\u2013S51","article-title":"Visualization in testing a volatile memory forensic tool","volume":"8","author":"Inoue Hajime","year":"2011","unstructured":"Hajime Inoue, Frank Adelstein, and Robert A. Joyce. 2011. Visualization in testing a volatile memory forensic tool. Digital Investigation 8 (2011), S42\u2013S51.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_20_2","volume-title":"Intel\u00a964 and IA-32 Architectures: Software Developer\u2019s Manual Volume 3A: System Programming Guide, Part 1","year":"2016","unstructured":"Intel Corporation. 2016. Intel\u00a964 and IA-32 Architectures: Software Developer\u2019s Manual Volume 3A: System Programming Guide, Part 1. Intel Corporation."},{"key":"e_1_3_3_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2805904"},{"key":"e_1_3_3_22_2","unstructured":"504ENSICS Labs. 2014. LiME\u2014Linux Memory Extractor. (2014). https:\/\/github.com\/504ensicsLabs\/LiME;Commit: 9c734770f27f79e392cb726c97871bc27fbd013b."},{"key":"e_1_3_3_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/359545.359563"},{"key":"e_1_3_3_24_2","doi-asserted-by":"crossref","unstructured":"Tobias Latzo Ralph Palutke and Felix Freiling. 2019. A universal taxonomy and survey of forensic memory acquisition techniques. Digital Investigation 28 (March 2019) 56\u201369.","DOI":"10.1016\/j.diin.2019.01.001"},{"issue":"4","key":"e_1_3_3_25_2","doi-asserted-by":"crossref","first-page":"31","DOI":"10.4018\/jdcf.2012100103","article-title":"Pypette: A platform for the evaluation of live digital forensics","volume":"4","author":"Lempereur Brett","year":"2012","unstructured":"Brett Lempereur, Madjid Merabti, and Qi Shi. 2012. Pypette: A platform for the evaluation of live digital forensics. International Journal of Digital Crime and Forensics 4, 4 (2012), 31\u201346.","journal-title":"International Journal of Digital Crime and Forensics"},{"key":"e_1_3_3_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2019.2930987"},{"key":"e_1_3_3_27_2","volume-title":"The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory","author":"Ligh Michael Hale","year":"2014","unstructured":"Michael Hale Ligh, Andrew Case, and Jamie Levy. 2014. The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Wiley. See also https:\/\/github.com\/volatilityfoundation\/volatility"},{"key":"e_1_3_3_28_2","first-page":"215","volume-title":"Proceedings of the International Workshop on Parallel and Distributed Algorithms","author":"Mattern Friedemann","year":"1989","unstructured":"Friedemann Mattern. 1989. Virtual time and global states of distributed systems. In Proceedings of the International Workshop on Parallel and Distributed Algorithms. 215\u2013226."},{"key":"e_1_3_3_29_2","doi-asserted-by":"crossref","unstructured":"Jenny Ottmann. 2023. An Experimental Assessment of Inconsistencies in Memory Dumps: Experimental Data. Retrieved October 30 2023 from 10.5281\/zenodo.8246001","DOI":"10.1145\/3628600"},{"key":"e_1_3_3_30_2","volume-title":"Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU\u201922)","author":"Ottmann Jenny","year":"2022","unstructured":"Jenny Ottmann, Frank Breitinger, and Felix Freiling. 2022. Defining atomicity (and integrity) for snapshots of storage in forensic computing. In Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU\u201922)."},{"key":"e_1_3_3_31_2","volume-title":"Proceedings of the Digital Forensics Research Conference USA (DFRWS USA\u201923)","author":"Ottmann Jenny","year":"2023","unstructured":"Jenny Ottmann, \u00dcsame Cengiz, Frank Breitinger, and Felix Freiling. 2023. As if time had stopped\u2014Checking memory dumps for quasi-instantaneous consistency. In Proceedings of the Digital Forensics Research Conference USA (DFRWS USA\u201923). 10.48550\/arXiv.2307.12060"},{"issue":"2","key":"e_1_3_3_32_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3310355","article-title":"Introducing the temporal dimension to memory forensics","volume":"22","author":"Pagani Fabio","year":"2019","unstructured":"Fabio Pagani, Oleksii Fedorov, and Davide Balzarotti. 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security 22, 2 (2019), 1\u201321.","journal-title":"ACM Transactions on Privacy and Security"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1007\/s004460050069"},{"key":"e_1_3_3_34_2","first-page":"S105\u2013S115","article-title":"Anti-forensic resilient memory acquisition","volume":"10","author":"St\u00fcttgen Johannes","year":"2013","unstructured":"Johannes St\u00fcttgen and Michael Cohen. 2013. Anti-forensic resilient memory acquisition. Digital Investigation 10 (2013), S105\u2013S115.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_35_2","volume-title":"Modern Operating Systems","author":"Tanenbaum Andrew","year":"2015","unstructured":"Andrew Tanenbaum and Herbert Bos. 2015. Modern Operating Systems. Pearson Education."},{"key":"e_1_3_3_36_2","volume-title":"Stress\u2014Tool to Impose Load on and Stress Test Systems","year":"2010","unstructured":"Ubuntu Man Pages. 2010. Stress\u2014Tool to Impose Load on and Stress Test Systems, v1.0.4. Ubuntu."},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2011.06.002"},{"issue":"2","key":"e_1_3_3_38_2","doi-asserted-by":"crossref","first-page":"125","DOI":"10.1016\/j.diin.2012.04.005","article-title":"Correctness, atomicity, and integrity: Defining criteria for forensically-sound memory acquisition","volume":"9","author":"V\u00f6mel Stefan","year":"2012","unstructured":"Stefan V\u00f6mel and Felix C. Freiling. 2012. Correctness, atomicity, and integrity: Defining criteria for forensically-sound memory acquisition. Digital Investigation 9, 2 (2012), 125\u2013137.","journal-title":"Digital Investigation"},{"key":"e_1_3_3_39_2","first-page":"S30\u2013S40","article-title":"An evaluation platform for forensic memory acquisition software","volume":"10","author":"V\u00f6mel Stefan","year":"2013","unstructured":"Stefan V\u00f6mel and Johannes St\u00fcttgen. 2013. An evaluation platform for forensic memory acquisition software. Digital Investigation 10 (2013), S30\u2013S40.","journal-title":"Digital Investigation"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3628600","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3628600","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:03:44Z","timestamp":1750291424000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3628600"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12,12]]},"references-count":38,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2024,2,29]]}},"alternative-id":["10.1145\/3628600"],"URL":"https:\/\/doi.org\/10.1145\/3628600","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,12,12]]},"assertion":[{"value":"2022-11-03","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-09-25","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-12-12","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}