Discovering Semantic Data of Interest from Un-mappable Memory with Confidence

Uncovering semantic data of interest in memory pages without memory mapping information is an important capability in computer forensics. Existing memory mappingguided techniques do not work in that scenario as pointers in the un-mappable memory cannot be resolved and navigated. To address this problem, we present a probabilistic inference-based approach called DIMSUM to enable the recognition of data structure instances from un-mappable memory. Given a set of memory pages and the specification of a target data structure, DIMSUM will identify instances of the data structure in those pages with quantifiable confidence. More specifically, it builds graphical models based on boolean constraints generated from the data structure and the memory page contents. Probabilistic inference is performed on the graphical models to generate results ranked with probabilities. Our experiments with realworld applications on both Linux and Android platforms show that DIMSUM achieves higher effectiveness than nonprobabilistic approaches without memory mapping information.