Approaches to Selective Imaging of Live Systems via Memory Forensics

Modern day forensic investigations rely on forensically sound digital evidence which is acceptable in a court of law. The increase cybersecurity attacks have enormously increased the need of forensic investigations leading to a huge corpus of data. Mostly, the memory image dump is so huge for individual cases out of which the critical evidence is present in a comparatively smaller amount of memory. Selective imaging provides a way to partially image the memory of target device without necessarily copying the rest of the image that may be of little or no use to the investigation. Selective imaging allows the investigator to forensically acquire memory in a strategic manner depending upon the nature of the case at hand. In this work, we explore the realm of selective imaging and present a consolidated literature review along with the various approaches available for considering selective memory imaging for live systems to conduct forensic investigations via live memory forensics. The work concludes by pointing the research directions around selective imaging for enhancing the effectiveness of live memory forensics.