Volatile Evidence: Memory Forensics in Digital Investigations

View Sample PDF

Author(s): Roshni Pandey (Gujarat University, India), Kiranbhai R. Dodiya (Gujarat University, India), Parvesh Sharma (Gujarat University, India)and Kapil Kumar (Gujarat University, India)
Copyright: 2026
Pages: 54
Source title: Policies Against Fraud and Cybercrime: Strategic, Legal, and Technological Approaches
Source Author(s)/Editor(s): Ricardo Marcão (ISLA Santarem, Polytechnic University, Portugal & NECE, University of Beira Interior, Portugal ), Vasco Ribeiro Santos (ISLA Santarém, Portugal & GOVCOPP, Portugal)and Nuno Mateus-Coelho (CTS UNINOVA, Portugal & Lusófona University, Portugal)
DOI: 10.4018/979-8-3373-5992-2.ch001

Keywords: Computer Science & IT / Cyber and Network Security / Information Science Reference / IT Policy & Standardization

Purchase

View Volatile Evidence: Memory Forensics in Digital Investigations on the publisher's website for pricing and purchasing information.

Abstract

Volatile evidence in system memory (RAM) has become vital in digital forensics, capturing live data such as active processes, network sessions, cryptographic keys, and malware fragments often absent from disk analysis. Its transient nature makes memory forensics essential for reconstructing attacks, uncovering sophisticated intrusions, and exposing anti-forensic tactics. This chapter examines key acquisition and analysis techniques, emphasizing challenges of volatility, scalability, and data integrity. It also explores advanced applications—like AI-driven anomaly detection, blockchain-based chain-of-custody, and quantum-safe approaches—positioning memory forensics as a cornerstone of next-generation digital investigations.

The IRMA Community

Research IRM

Volatile Evidence: Memory Forensics in Digital Investigations

Purchase

Abstract

Related Content

IRMA Sponsors