关键词: 内存取证, Windows 8, 进程, 线程, 物理内存分析

Abstract: Memory forensics is a branch of importance in computer forensics, and searching for processes and threads in physical memory dumps is crucial and challenging for memory forensics. This paper investigates the searching of processes and threads in physical memory dumps based on the latest Microsoft operation system Windows 8. By utilizing reverse engineering techniques, the kernel data structures regarding processes and threads on Windows 8 are explored, and their features are identified. Based on these features, an algorithm is proposed for searching processes and threads in Windows 8 physical memory dumps. Experimental results and their analysis indicate that it is capable of extracting information about hidden and non-hidden processes and their threads successfully, thereby providing reliable data foundation for further analysis in memory forensics.

Key words: memory forensics, Windows 8, process, thread, physical memory analysis