Using Every Part of the Buffalo in Windows Memory Analysis∗

All Windows memory analysis techniques depend on the examiner’s ability to translate the virtual addresses used by programs and operating system components into the true locations of data in a memory image. In some mem-ory images up to 20 % of all the virtual addresses in use point to so called “invalid ” pages that cannot be found us-ing a naive method for address translation. This paper ex-plains virtual address translation, enumerates the different states of invalid memory pages, and presents a more ro-bust strategy for address translation. This new method in-corporates invalid pages and even the paging file to greatly increase the completeness of the analysis. By using ev-ery available page, every part of the buffalo as it were, the examiner can more accurately recreate the state of the machine as it existed at the time of imaging