Uncategorized
Reconstructing User Activities from a Memory Dump
Child exploitation cases often involve analyzing digital device storage drives to reconstruct user activities. While much can be learned from disk analysis, Random Access Memory (RAM) is a particularly rich source of potential evidence related to user activities. Specifically, reconstruction of user activities from a RAM dump can help establish Read more…