The memory forensic research oriented to segment heap in Windows 10 system

The current forensic research on heaps mainly extracts information from the heap of Linux and the NT heap of Windows. However, the study of how to extract the information on the segment heap in the Windows 10 from dump files is not sufficient. To reproduce the internal information on the segment hea...

Full description

Bibliographic Details

Published in:	Xibei Gongye Daxue Xuebao
Main Authors:	ZHAI Jiqiang, CHEN Pan, XU Xiao, YANG Hailu
Format:	Article
Language:	Chinese
Published:	EDP Sciences 2021-10-01
Subjects:	nt heap pool scanning technology segment heap volatility framework
Online Access:	https://www.jnwpu.org/articles/jnwpu/full_html/2021/05/jnwpu2021395p1139/jnwpu2021395p1139.html