0

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am trying to look at. I obtain a full memory and kernel image minutes later of the detection and I am unable to find the local process ID that my EDR reported.

0

1 Answer 1

1

They are not gone immediately, but they begin to disappear shortly after. Windows will mark all those pages as unused, and every time a process allocates more memory, those pages can be used and their contents overwritten.

And not only that, but when the process is running, Windows keeps track of all pages belonging to that process and you can reference them all easily. With the process gone, you don't have the references anymore and have to comb the entire memory space looking for unallocated pages and finding data on them, and that's not easy. And if you find something interesting, there's no easy way to tell which process owned that page before.

The best way is to grab the system image before the process exits. If that is not possible, your chances of grabbing anything significant is between very hard and impossible.

1
  • Thanks for the clarification. This is gong to be a hard one to track down!
    – antmar904
    Jun 29, 2021 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .