Now You See Me: Hide and Seek in Physical Address Space

With the growing complexity of computing systems, memory based forensic techniques are becoming instrumental in digital investiga-tions. Digital forensic examiners can unravel what happened on a system by acquiring and inspecting in-memory data. Meanwhile, attackers have developed numerous anti-forensic mechanisms to defeat existing memory forensic techniques by manipulation of sys-tem software such as OS kernel. To counter anti-forensic tech-niques, some recent researches suggest that memory acquisition process can be trusted if the acquisition module has not been tam-pered with and all the operations are performed without relying on any untrusted software including the operating system. However, in this paper, we show that it is possible for malware to bypass the current state-of-art trusted memory acquisition module by manipulating the physical address space layout, which is share