Судово-експертне дослідження артефактів енергозалежної пам’яті (RAM) при розслідуванні інцидентів компрометації інформаційних систем

Abstract

This paper examines the issue of forensic analysis of volatile memory (RAM) during cybercrime investigations. It analyzes common cyberattacks, such as the spread of fileless malware and methods of executing code directly in RAM (in-memory execution). At the same time, the application of computer forensics methods that focus exclusively on nonvolatile storage media proves insufficient to counter such cyber threats. The paper presents various methods for obtaining electronic evidence, taking into account the principle of prioritizing data collection based on volatility. In addition, a method for detecting security incidents using the analysis of virtual address descriptors (VAD) is described. This method detects anomalies in memory allocation that indicate the use of process obfuscation techniques and the unauthorized injection of malicious code. The necessity of reconstructing network connections and extracting residual cryptographic data from uncategorized memory regions is justified. Thus, the standardization of protocols for the forensic analysis of non-volatile memory is a necessary prerequisite for ensuring the admissibility and reliability of electronic evidence in criminal cases.