Investigating RAM in a mobile device
Investigating RAM in a Mobile Device
This whitepaper by Dave Lauder examines what kind of data can be found in a mobile device’s RAM and how it can support a forensic investigation.
It explains the difference between data “at rest” and data “in transit,” and shows how transient memory can contain valuable information such as user input, app activity, and system data. The paper also discusses proportionality, device states, and examples of real analysis performed with MSAB’s RAMalyzer tool.
Download the whitepaper to learn more about how RAM analysis can reveal new sources of digital evidence.
Related Guides
The DFIR Efficiency Playbook: Streamlining Investigations with More Productive Labs
With the ever-increasing number of devices, data, and encryption that accompany most...
How to Extract More Phones Faster: 5 steps to make the most out of your time in the DFU
As technology permeates almost every facet of human activity, the relevance of...
How Did That Photo Get on That iPhone? – Deep Dive into the iOS “Photos.sqlite” database
Usually, the content of a photo, its EXIF information (if available),...