{'fraction_non_alphanumeric': 0.011922503725782414, 'fraction_numerical': 0.0, 'mean_word_length': 5.280373831775701, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Physical Memory Forensics for Files and Cache

Physical memory forensics has gained a lot of traction over the past five or six years. While it will never eliminate the need for disk forensics, memory analysis has proven its efficacy during incident response and more traditional forensic investigations. Since attackers typically live in userland memory, reconstructing the processes in that space is essential to an investigation. While previous reconstruction techniques in this area have shown promise, they have left room for improvement. This paper will focus on file reconstruction as a method of reducing unknown data in memory and accelerating forensic analysis.