View source for Acquisition and analysis of volatile memory from Android devices

{{Publication
|Botnet=,
|Malware=,
|CCProtocol=,
|Operation=,
|Year=2012
|Date=2012-02
|Editor=Elsevier
|Link=http://digitalforensicssolutions.com/papers/android-memory-analysis-DI.pdf
|DOI=10.1016/j.diin.2011.10.003
|Author=Joe Sylve, Andrew Case, Lodovico Marziale, Golden G. Richard,
|Abstract=The Android operating system for mobile phones, which is still relatively new, is rapidly gaining market share, with dozens of smartphones and tablets either released or set to be released. In this paper, we present the ﬁrst methodology and toolset for acquisition and deep analysis of volatile physical memory from Android devices. The paper discusses some of the challenges in performing Android memory acquisition, discusses our new kernel module for dumping memory, named dmd, and  speciﬁcally addresses the difﬁculties in developing device-independent acquisition tools. Our acquisition tool supports dumping memory to either the SD on the phone or via the network. We also present analysis of kernel structures using newly developed Volatility functionality. The results of this work illustrate the potential that deep memory analysis offers to digital forensics investigators.
|Document=
|Licence=
|Video=
|NomRevue=Digital Investigation
|ISBN=
|Page=
|Keyword=Android, Memory forensics, Memory analysis, Linux, Mobile device forensics
}}