{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T02:19:27Z","timestamp":1769912367722,"version":"3.49.0"},"reference-count":21,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2016,6,27]],"date-time":"2016-06-27T00:00:00Z","timestamp":1466985600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province (CN)","doi-asserted-by":"publisher","award":["ZR2014FM003"],"award-info":[{"award-number":["ZR2014FM003"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Outstanding Young Scientists Research Award","award":["BS2014DX007"],"award-info":[{"award-number":["BS2014DX007"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61472225"],"award-info":[{"award-number":["61472225"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["EURASIP J. on Info. Security"],"published-print":{"date-parts":[[2016,12]]},"DOI":"10.1186\/s13635-016-0038-z","type":"journal-article","created":{"date-parts":[[2016,6,27]],"date-time":"2016-06-27T09:20:35Z","timestamp":1467019235000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["An adaptive approach for Linux memory analysis based on kernel code reconstruction"],"prefix":"10.1186","volume":"2016","author":[{"given":"Shuhui","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiangxu","family":"Meng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lianhai","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,6,27]]},"reference":[{"key":"38_CR1","unstructured":"DFRWS 2005 Forensics Challenge. \n                    http:\/\/www.dfrws.org\/conferences\/dfrws-usa-2005\n                    \n                  ."},{"key":"38_CR2","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1007\/978-3-642-23602-0_8","volume":"56","author":"L Wang","year":"2010","unstructured":"L Wang, L Xu, S Zhang, Network connections information extraction of 64-bit windows 7 memory images. Forensics in Telecommunications, Information, and Multimedia. 56:, 90\u201398 (2010).","journal-title":"Forensics in Telecommunications, Information, and Multimedia"},{"key":"38_CR3","unstructured":"DFRWS 2005 Forensics Challenge: Memparser. \n                    http:\/\/sourceforge.net\/projects\/memparser\n                    \n                  ."},{"key":"38_CR4","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1016\/j.diin.2006.06.010","volume":"3","author":"A Schuster","year":"2006","unstructured":"A Schuster, Searching for processes and threads in microsoft windows memory dumps. Digit. Investig. 3:, 10\u201316 (2006).","journal-title":"Digit. Investig"},{"key":"38_CR5","doi-asserted-by":"publisher","first-page":"677","DOI":"10.1109\/IAS.2009.103","volume":"2","author":"R Zhang","year":"2009","unstructured":"R Zhang, L Wang, S Zhang, Windows memory analysis based on kpcr. Fifth International Conference On Information Assurance and Security. 2:, 677\u2013680 (2009).","journal-title":"Fifth International Conference On Information Assurance and Security"},{"issue":"1","key":"38_CR6","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1016\/j.diin.2006.12.002","volume":"4","author":"JD Kornblum","year":"2007","unstructured":"JD Kornblum, Using every part of the buffalo in windows memory analysis. Digit Investig. 4(1), 24\u201329 (2007).","journal-title":"Digit Investig"},{"key":"38_CR7","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1016\/j.diin.2008.05.007","volume":"5","author":"A Schuster","year":"2008","unstructured":"A Schuster, The impact of microsoft windows pool allocation strategies on memory forensics. Digit. Investig.5:, 58\u201364 (2008).","journal-title":"Digit. Investig."},{"key":"38_CR8","first-page":"373","volume":"6","author":"S Zhang","year":"2010","unstructured":"S Zhang, L Wang, R Zhang, Q Guo, Exploratory study on memory analysis of windows 7 operating system. 3rd International Conference On Advanced Computer Theory and Engineering (ICACTE). 6:, 373\u2013377 (2010).","journal-title":"3rd International Conference On Advanced Computer Theory and Engineering (ICACTE)"},{"key":"38_CR9","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1016\/j.diin.2008.05.003","volume":"5","author":"B Dolan-Gavitt","year":"2008","unstructured":"B Dolan-Gavitt, Forensic analysis of the windows registry in memory. Digit. Investig.5:, 26\u201332 (2008).","journal-title":"Digit. Investig."},{"key":"38_CR10","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1016\/j.diin.2008.05.014","volume":"5","author":"R Van Baar","year":"2008","unstructured":"R Van Baar, W Alink, A Van Ballegooij, Forensic memory analysis: Files mapped in memory. Digit. Investig.5:, 52\u201357 (2008).","journal-title":"Digit. Investig."},{"key":"38_CR11","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1016\/j.diin.2009.06.003","volume":"6","author":"S Hejazi","year":"2009","unstructured":"S Hejazi, C Talhi, M Debbabi, Extraction of forensically sensitive information from windows physical memory. Digit. Investig.6:, 121\u2013131 (2009).","journal-title":"Digit. Investig."},{"issue":"1","key":"38_CR12","doi-asserted-by":"publisher","first-page":"3","DOI":"10.4304\/jcp.4.1.3-10","volume":"4","author":"Q Zhao","year":"2009","unstructured":"Q Zhao, T Cao, Collecting sensitive information from windows physical memory. J. Comput.4(1), 3\u201310 (2009).","journal-title":"J. Comput."},{"key":"38_CR13","volume-title":"Practical Malware Analysis: the Hands-on Guide to Dissecting Malicious Software","author":"M Sikorski","year":"2012","unstructured":"M Sikorski, A Honig, Practical Malware Analysis: the Hands-on Guide to Dissecting Malicious Software (no starch press, Scn Francisco, 2012)."},{"key":"38_CR14","unstructured":"A Ligh, MH Case, J Levy, A Walters, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory (John Wiley & Sons, 2014)."},{"key":"38_CR15","unstructured":"Volatility: Linux Memory Forensics. \n                    https:\/\/code.google.com\/archive\/p\/volatility\/wikis\/LinuxMemoryForensics.wiki\n                    \n                  ."},{"key":"38_CR16","unstructured":"Rekall Memory Forensic Framework. \n                    http:\/\/www.rekall-forensic.com\/\n                    \n                  ."},{"key":"38_CR17","doi-asserted-by":"publisher","first-page":"38","DOI":"10.1016\/j.diin.2015.01.009","volume":"12","author":"MI Cohen","year":"2015","unstructured":"MI Cohen, Characterization of the windows kernel version variability for accurate memory analysis. Digit. Investig.12:, 38\u201349 (2015).","journal-title":"Digit. Investig."},{"issue":"4","key":"38_CR18","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1016\/j.diin.2006.10.001","volume":"3","author":"A Petroni","year":"2006","unstructured":"A Petroni, NL Walters, T Fraser, WA Arbaugh, Fatkit: A framework for the extraction and analysis of digital forensic data from volatile system memory. Digit. Investig.3(4), 197\u2013210 (2006).","journal-title":"Digit. Investig."},{"key":"38_CR19","unstructured":"SecondLook Linux Memory Dump Samples. \n                    https:\/\/www.forcepoint.com\/\n                    \n                  ."},{"key":"38_CR20","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1016\/j.diin.2010.05.005","volume":"7","author":"A Case","year":"2010","unstructured":"A Case, L Marziale, GG Richard, Dynamic recreation of kernel data structures for live forensics. Digit. Investig.7:, 32\u201340 (2010).","journal-title":"Digit. Investig."},{"key":"38_CR21","unstructured":"T Haruyama, H Suzuki. >\n                    https:\/\/media.blackhat.com\/bh-eu-12\/Haruyama\/bh-eu-12-Haruyama-Memory_Forensic-Slides.pdf\n                    \n                  ."}],"container-title":["EURASIP Journal on Information Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1186\/s13635-016-0038-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1186\/s13635-016-0038-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1186\/s13635-016-0038-z","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1186\/s13635-016-0038-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,4,30]],"date-time":"2017-04-30T16:57:04Z","timestamp":1493571424000},"score":1,"resource":{"primary":{"URL":"https:\/\/jis-eurasipjournals.springeropen.com\/articles\/10.1186\/s13635-016-0038-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,6,27]]},"references-count":21,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2016,12]]}},"alternative-id":["38"],"URL":"https:\/\/doi.org\/10.1186\/s13635-016-0038-z","relation":{},"ISSN":["1687-417X"],"issn-type":[{"value":"1687-417X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,6,27]]},"article-number":"14"}}