Search

Through a systematic literature review, which is considered the most comprehensive way to analyze the field of memory forensics, this paper investigates its development through past and current methodologies, as well as future trends. This paper systematically starts with an introduction to the key issues and a notable agenda of the research questions. Appropriate inclusion and exclusion criteria were then developed, and a deliberate search strategy was adopted to identify primary research studies aligned with the research question. The paper goes into specific details of six different memory categories, notably volatile memory, interpreting their advantages and the tactics used to retrieve the data. A detailed comparison with existing reviews and other relevant papers is made, forming a broader and wider picture of the research. The discussion summarizes the main findings, particularly the rise of more complex and advanced cyber threats and the necessity of more effective forensic methods for their investigation. This review pinpoints the possibilities for future study with the purpose of staying ahead in the evolving technological landscape. This overview is undoubtedly an essential resource for professionals and researchers working in digital forensics. It allows them to stay competent and provides enough insight into the current trends while marking the future direction in digital forensics methodology. [ABSTRACT FROM AUTHOR]

Reservoir computing is a highly efficient machine learning framework for processing temporal data by extracting input features and mapping them into higher dimensional spaces. Physical reservoirs have been realized using spintronic oscillators, atomic switch networks, volatile memristors, etc. However, these devices are intrinsically energy‐dissipative due to their resistive nature, increasing their power consumption. Therefore, memcapacitive devices can provide a more energy‐efficient approach. Herein, volatile biomembrane‐based memcapacitors are leveraged as reservoirs to solve classification tasks and process time series in simulation and experimentally. This system achieves a 99.6% accuracy for spoken‐digit classification and a normalized mean square error of 7.81×10−4$7.81 \times \left(10\right)^{- 4}$ in a second‐order nonlinear regression task. Furthermore, to showcase the device's real‐time temporal data processing capability, a 100% accuracy for an epilepsy detection problem is achieved. Most importantly, it is demonstrated that each memcapacitor consumes an average of 41.5 fJ of energy per spike, regardless of the selected input voltage pulse width, while maintaining an average power of 415 fW for a pulse width of 100 ms, orders of magnitude lower than those achieved by state‐of‐the‐art devices. Lastly, it is believed that the biocompatible, soft nature of our memcapacitor renders it highly suitable for computing applications in biological environments. [ABSTRACT FROM AUTHOR]

Perpetual exigency for environment friendly clean energy and powerful soft electronics has elevated the research on hydrogels in past two decades. Hydrogels are the amplifiers of material properties using manipulation in structure–property relationship via simple, economic yet effective routes. Herein, a set of composite and hybrid hydrogels are developed by hierarchical assembling of clay nanosheets and surfactant micelles those divulge the first example of memcapacitor gels and offer exceptional proton conductivity (1.66–4.34 × 10–2 S cm−1) as a gel material. Further, Congo red, Eosin Y, and Orange G are used to hybridize one of the composites to achieve three hybrid hydrogels. Such hybridization is found to regulate the memristive function selectively from the coupled effect of memcapacitance from the composite. The composite hydrogel highlights its volatile memory with encouraging robustness under environmental conditions, established through various current–voltage (I–V) experiments. The electrochemical behaviors including the high proton conductivity are realized from impedance measurements. Material characterizations, experimental results, and in silico optimized structures rationalize composite/hybrid network formation, capacitive/memristive responses, and enhanced proton conduction in the fabricated composite superstructures. Proposed structural models demonstrate two orthogonally oriented structural encryptions to be accountable for the expressed bifunctionality in the hierarchically designed superstructures. [ABSTRACT FROM AUTHOR]

The collection and analysis of volatile memory is a vibrant area of research in the cybersecurity community. The ever-evolving and growing threat landscape is trending towards fileless malware, which avoids traditional detection but can be found by examining a system’s random access memory (RAM). Additionally, volatile memory analysis offers great insight into other malicious vectors. It contains fragments of encrypted files’ contents, as well as lists of running processes, imported modules, and network connections, all of which are difficult or impossible to extract from the file system. For these compelling reasons, recent research efforts have focused on the collection of memory snapshots and methods to analyze them for the presence of malware. However, to the best of our knowledge, no current reviews or surveys exist that systematize the research on both memory acquisition and analysis. We fill that gap with this novel survey by exploring the state-of-the-art tools and techniques for volatile memory acquisition and analysis for malware identification. For memory acquisition methods, we explore the trade-offs many techniques make between snapshot quality, performance overhead, and security. For memory analysis, we examined the traditional forensic methods used, including signature-based methods, dynamic methods performed in a sandbox environment, as well as machine learning-based approaches. We summarize the currently available tools, and suggest areas for more research.

Graphics processing units (GPUs) achieve high throughput by exploiting a high degree of thread-level parallelism (TLP). To support such high TLP, GPUs have a large-sized register file to store the context of all threads, consuming around 20% of total GPU energy. Several previous studies have attempted to minimize the energy consumption of the register file by implementing an emerging non-volatile memory (NVM), leveraging its higher density and lower leakage power over SRAMs. To amortize the cost of long access latency of NVM, prior work adopts a hierarchical register file consisting of an SRAM-based register cache and NVM-based registers where the register cache works as a write buffer. To get the register cache index, they use the partially selected bits of warp ID and register ID. This work observes that such an index calculation causes three types of contentions leading to the underutilization of the register cache: inter-warp, intra-warp, and false contentions. To minimize such contentions, this paper proposes a thread context-aware register cache (TEA-RC) in GPUs. In TEA-RC, the cache index is calculated considering the high correlation between the number of scheduled threads and the register usage of threads. The proposed design shows 28.5% higher performance and 9.1 percentage point lower energy consumption over the conventional register cache that concatenates three bits of warp ID and five bits of register ID to compute the cache index.

The collection and analysis of volatile memory is a vibrant area of research in the cybersecurity community. The ever-evolving and growing threat landscape is trending towards fileless malware, which avoids traditional detection but can be found by examining a system's random access memory (RAM). Additionally, volatile memory analysis offers great insight into other malicious vectors. It contains fragments of encrypted files' contents, as well as lists of running processes, imported modules, and network connections, all of which are difficult or impossible to extract from the file system. For these compelling reasons, recent research efforts have focused on the collection of memory snapshots and methods to analyze them for the presence of malware. However, to the best of our knowledge, no current reviews or surveys exist that systematize the research on both memory acquisition and analysis. We fill that gap with this novel survey by exploring the state-of-the-art tools and techniques for volatile memory acquisition and analysis for malware identification. For memory acquisition methods, we explore the trade-offs many techniques make between snapshot quality, performance overhead, and security. For memory analysis, we examined the traditional forensic methods used, including signature-based methods, dynamic methods performed in a sandbox environment, as well as machine learning-based approaches. We summarize the currently available tools, and suggest areas for more research. [ABSTRACT FROM AUTHOR]

Ransomware is an emerging category of malware that locks computer data via powerful cryptographic algorithms. The global propagation of ransomware is a serious threat for individuals and organizations. The banking sector and financial institutions are the prime targets of such ransomware attacks. In case of such an attack, the field of digital forensics helps in estimation of the severity and data loss caused by the attack. Traditional digital forensics investigations make use of static or behavioral analysis to detect malware in infected systems. However, these procedures are challenged by malware obfuscation techniques. Malicious processes can stay inactive and undetected if only a single memory dump is analyzed. Thus, there is a need to collect numerous memory dumps of an individual program that can help with comprehensive and accurate analysis. In this article, we have developed a framework for volatile memory acquisition at regular time intervals to analyze the behavior of individual processes in memory. Through memory forensics, salient features are extracted from the infected memory dumps. These features can be utilized to classify malicious and benign processes efficiently through machine learning as compared to conventional techniques. [ABSTRACT FROM AUTHOR]

Artificial synaptic devices are emerging as contenders for next-generation computing systems due to their combined advantages of self-adaptive learning mechanisms, high parallel computation capabilities, adjustable memory level, and energy efficiency. Optoelectronic devices are particularly notable for their responsiveness to both voltage inputs and light exposure, making them attractive for dynamic modulation. However, engineering devices with reconfigurable synaptic plasticity and multilevel memory within a singular configuration present a fundamental challenge. Here, we have established an organic transistor-based synaptic device that exhibits both volatile and nonvolatile memory characteristics, modulated through gate voltage together with light stimuli. Our device demonstrates a range of synaptic behaviors, including both short/long-term plasticity (STP and LTP) as well as STP-LTP transitions. Further, as an encoding unit, it delivers exceptional read current levels, achieving a program/erase current ratio exceeding 10 5 , with excellent repeatability. Additionally, a prototype 4 × 4 matrix demonstrates potential in practical neuromorphic systems, showing capabilities in the perception, processing, and memory retention of image inputs.

Understanding the switching mechanism of the volatile resistive switching random access memory (RRAM) device is important to harness its characteristics and further enhance its performance. Accurate modeling of its dynamic behavior is also of deep value for its applications both as selector and as short-term memory synapse for future neuromorphic applications operating in temporal domain. In this work, we investigate the switching and retention (relaxation) processes of the Ag-based metallic filamentary volatile resistive switching devices. We find that the switching process can be modeled by the ionic drift under electric field, while the retention process can be modeled by the ionic diffusion along the filament surface driven by the gradient of surface atomic concentration. Through further theoretical analysis, we also find that the ionic drift and ionic diffusion can be unified within the general Einstein relation. To confirm this relation, we collect ionic mobility and diffusivity data from the literature using the switching and retention model. Finally, we show that the read voltage dependent retention time can be explained by the competition between the ionic drift and diffusion flux. [ABSTRACT FROM AUTHOR]

This paper presents an evidence for involvement of long-termmemory (LTM) resources along volatile memory (VM) resourcesin active management of information in a workingmemory (WM) task that features schematic processing ofWMcontent. It was observed that in rehearsing frequently changingWM items in a self-paced concurrent-counting task whensubjects learn and use a fixed rehearsing order across differentepisodes of the task they make significantly less error comparedto when they adopt different rehearsing order for differentepisodes. This finding suggests that while retaining informationin this task practically draws on volatile resourcessuch as the phonological loop (PL), access to the correspondingitem in WM relies on learning and retaining data structuresin LTM. It is discussed that in this role learning and LTMresources help render schematic access to episodic informationstored in less structured storage units such as PL. In thisrole LTM and learning plays a crucial role in execution ofWMtasks that employ complex process schemas.

This paper describes an evolutionarily plausible description of ofa specialized working memory system involved in informationmanagement for high-order cognitive tasks through its capabilityfor controlled maintenance and schematic access to symbolic representations.Along a volatile serially accessible symbolic storagethat serves a basic maintenance function the system utilizesother accessory volatile memory systems along long-term memory(LTM) and learning systems for execution of schematic accessto its content. Accessory systems can help encode the episodicinformation including the current state of the task and more importantlyprovide a means for address-based access to the contentof symbolic storage. LTM and learning systems help map the currentstate of the task onto execution programs and thus help renderschematic access and process of the retained symbolic information.Implications of this feature of the model are examined forthe case if concurrent-counting task.

The development of artificial intelligence and big data analytics is driving a revolution in methods for data processing and storage. Confronting speed and energy consumption issues, these fields require new computing systems to parallelly retrieve, process, and store massive amounts of data. Beyond CMOS devices and technology, advances in data storage technology such as static random‐access memory, dynamic random‐access memory, flash memories, resistive memories, phase change memories, and magnetic memories have made functional computing possible. In this article, a broad overview of current memory systems and their development history spanning fundamental operating schemes, prevailing applications and required figure of merits for applications such as in‐memory computing and some critical issues that need to be addressed in the future development of this emerging technique are provided. [ABSTRACT FROM AUTHOR]

Temperature is often not considered as a precision stimulus for artificial chemical systems in contrast to the host–guest interactions related to many natural processes. Similarly, mimicking multi‐state volatile memory operations using a single molecular system with temperature as a precision stimulus is highly laborious. Here we demonstrate how a mixture of iron(II) chloride and bipyridine can be used as a reversible color‐to‐colorless thermochromic switch and logic operators. The generality of the approach was illustrated using CoII and NiII salts that resulted in color‐to‐color transitions. DMSO gels of these systems, exhibited reversible opaque‐transparency switching. More importantly, optically readable multi‐state volatile memory with temperature as a precision input has been demonstrated. The stored data is volatile and is lost instantaneously upon withdrawal or change of temperature. Simultaneous read‐out at multiple wavelengths results in single‐input/multi‐output sequential logic operations such as data accumulators (counters) leading to volatile memory states. The present system provides access to thermoresponsive materials wherein temperature can be used as a precision stimulus. [ABSTRACT FROM AUTHOR]

Recent advancements in reservoir computing (RC) research have created a demand for analogue devices with dynamics that can facilitate the physical implementation of reservoirs, promising faster information processing while consuming less energy and occupying a smaller area footprint. Studies have demonstrated that dynamic memristors, with nonlinear and short-term memory dynamics, are excellent candidates as information-processing devices or reservoirs for temporal classification and prediction tasks. Previous implementations relied on nominally identical memristors that applied the same nonlinear transformation to the input data, which is not enough to achieve a rich state space. To address this limitation, researchers either diversified the data encoding across multiple memristors or harnessed the stochastic device-to-device variability among the memristors. However, this approach requires additional preprocessing steps and leads to synchronization issues. Instead, it is preferable to encode the data once and pass them through a reservoir layer consisting of memristors with distinct dynamics. Here, we demonstrate that ion-channel-based memristors with voltage-dependent dynamics can be controllably and predictively tuned through the voltage or adjustment of the ion channel concentration to exhibit diverse dynamic properties. We show, through experiments and simulations, that reservoir layers constructed with a small number of distinct memristors exhibit significantly higher predictive and classification accuracies with a single data encoding. We found that for a second-order nonlinear dynamical system prediction task, the varied memristor reservoir experimentally achieved an impressive normalized mean square error of 1.5 × 10 -3 , using only five distinct memristors. Moreover, in a neural activity classification task, a reservoir of just three distinct memristors experimentally attained an accuracy of 96.5%. This work lays the foundation for next-generation physical RC systems that can exploit the complex dynamics of their diverse building blocks to achieve increased signal processing capabilities.

Many thin film-based devices with solid electrolytes have been studied for memristive applications. Herein, we report a simple and facile way to fabricate solution-based, low-cost, and discrete two-terminal memristive devices using the KMnO _4 solution. The water and methanol were used as a solvent to prepare different concentrations of KMnO _4 to carry out the optimization study. Furthermore, the effect of KMnO _4 concentration with aqueous and methanol solvents was studied with the help of current-voltage, device charge, charge-flux, and cyclic endurance properties. Interestingly, all developed devices show the asymmetric time-domain charge and double valued charge-flux properties, suggesting that aqueous KMnO _4 and methanol-KMnO _4 based devices are non-ideal memristors or memristive devices. The statistical measures such as cumulative probability and coefficient of variation are reported for the memristive devices. The possible switching mechanism of the discrete memristive was tried to explain with the UV-visible spectrum and theoretical framework. The optimized device was further studied using the cyclic voltammogram, Bode plot, and Nyquist plot. An equivalent circuit was derived for the optimized discrete memristive device using electrochemical impendence spectroscopy results. The results of the present investigation are beneficial to develop programmable analog circuits, volatile memory, and synaptic devices using discrete memristive devices.

We demonstrate the nonvolatile and volatile memory characteristics of a gate-all-around silicon nanowire feedback field-effect transistor (FBFET) with a nitride charge-storage layer analyzed by a commercial TCAD simulator. Our FBFET exhibits a threshold voltage window of 0.76 V with a programming/erasing time of ${1}~\mu \text{s}$ in the nonvolatile memory mode. We investigated the delay of read operations with accumulated charges in the intrinsic channel region in this memory mode. Moreover, the FBFET exhibits a sensing margin of 6.3 $\mu \text{A}$ and a read/write speed of 10 ns with an outstanding retention time, as well as nondestructive read characteristics in the volatile memory mode, allowing this device to operate without any refresh operation. In addition, we describe the operating principle of our device and demonstrate its potential as integrated memory for 3-D integrations. [ABSTRACT FROM AUTHOR]

The present study is based on effect of dispersing Cd1−xZnxS/ZnS core/shell quantum dots (QDs) on the memory behaviour of nematic liquid crystal 2020 with the variation of dopant concentration and applied voltage. Around 26% and 45% memory storage in QDs dispersed nematic matrix (MIX 1 and MIX 2) has been the core finding. The presence of ionic charges at low-frequency regime along with their reduction in QDs dispersed nematic matrix has been confirmed from tan δ curve. Pure nematic LC as well as nematic/QD mixtures depict volatile memory effect that depends upon concentration of QDs. The existence of memory due to storage of charge on QDs has been further confirmed from the dielectric, polarising optical micrographs and electro optical study under the influence of bias voltage. The observation of memory effect is attributed to the ion capturing and ion releasing phenomenon. The dispersion of QDs in nematic material plays an important role to enhance memory parameter by capturing and releasing the ionic charges under the application of bias voltage which has been confirmed from capacitance-voltage curve. [ABSTRACT FROM AUTHOR]

A recently reported zero impact ionization and zero subthreshold swing device Z2FET is a promising candidate for capacitor-less dynamic random access memory (DRAM) memory cell. In the memory operation, data retention time determines refresh frequency and is one of the most important memory merits. In this paper, we have systematically investigated the Z2FET retention time based on a newly proposed characterization methodology. It is found that the degradation of HOLD “0” retention time originates from the gated-silicon on insulator (SOI) portion rather than the intrinsic-SOI region of the Z2FET. Electrons accumulate under front gate and finally collapse the potential barrier turning logic “0”–“1.” It appears that Shockley–Read–Hall (SRH) generation is the main source for electrons accumulation. Z2FET scalability has been investigated in terms of retention time. As the Z2FET is downscaled, the mechanism dominating electrons accumulation switches from SRH to parasitic injection of electrons from the cathode. The results show that the downscaling of Lg has little effect on data “0” retention, but Lin is limited to ~125 nm. An optimization method of the fabrication process is proposed based on this new understanding, and Lin can be further scaled down to 75 nm. We have demonstrated by 2-D TCAD simulation that Z2FET is a promising DRAM cells’ candidate particularly for Internet-of-Things applications. [ABSTRACT FROM AUTHOR]

Physical memory acquisition has been an import facet for digital forensics (DF) specialists due to its volatile characteristics. Nowadays, thousands of millions of global participants utilize online social networking (OSN) mechanisms to expand their social lives, ranging from business-oriented purposes to leisure motivations. Facebook (FB) is one of the most dominant social networking sites (SNS) available today. Unfortunately, it has been a major avenue for cybercriminals to commit illegal activities. Therefore, the digital traces of previous sessions of an FB user play an essential role as the first step for DF experts to pursue the disclosure of the identity of the suspect who was exploiting FB. In this research work, we provide a systematic methodology to reveal a previous session of an FB identity, as well as his/her partial social circle via collecting, analyzing, preserving and presenting the associated digital traces to obtain the online social snapshots of a specific FB user who was utilizing a computing device with Internet Explorer (IE) 10 without turning off the power of the gadget. This novel approach can be a paradigm for how DF specialists ponder the crime scene to conduct the first response in order to avoid the permanent loss of the precious digital evidence in previous FB sessions. The hash values of the image files of the random access memory (RAM) of the computing device have proven to be identical before and after forensics operations, which could be probative evidence in a court of law.

Most organizations today employ cloud-computing environments and virtualization technology; Due to their prevalence and importance in providing services to the entire organization, virtual-servers are constantly targeted by cyber-attacks, and specifically by malware. Existing solutions, consisting of the widely-used antivirus (AV) software, fail to detect newly created and unknown-malware; moreover, by the time the AV is updated, the organization has already been attacked. In this paper, we present a during run-time analysis methodology for a trusted detection of unknown malware on virtual machines (VMs). We conducted trusted analysis of volatile memory dumps taken from a VM and focused on analyzing their system-calls using a sequential-mining-method. We leveraged the most informative system-calls by machine-learning algorithms for the efficient detection of malware in widely used VMs within organizations (i.e. IIS and Email server). We evaluated our methodology in a comprehensive set of experiments over a collections of real-world, advanced, and notorious malware (both ransomware and RAT), and legitimate programs. The results show that our suggested methodology is able to detect the presence of unknown malware, in an average of 97.9% TPR and 0% FPR. Such results and capabilities can form the ground for the development of practical detection-tools for both corporates and companies. [ABSTRACT FROM AUTHOR]

Abstract: A comprehensive understanding of resistive switching phenomenon and its dependence on molecular structure is imperative for enhancing the consistency and reliability of organic resistive memory (ORM) devices. Here, the efforts are directed to establish a premise for providing detailed insights into the molecular property, thin film assembly, and digital memory performance of a 1,4‐dihydropyrrolo[3,2‐b]pyrrole (DHPP) derivative. The fabricated devices display switching characteristics with an ION/OFF ratio of ≈105, howbeit, with a “temporary remanence” of ≈2 min. The ON state can be sustained under a constant electrical duress of −1 V and can be repeatedly reprogrammed for >110 cycles. Conductive atomic force microscope (C‐AFM) studies demonstrate that the thin film can be electrically written to a “0” or “1” state under extremely low compliance currents of ±250 pA with an appreciable ON/OFF ratio of 102. Conservative estimates for the switching area of ≈150 nm2 with energy as low as 15 fJ to induce a switching event underscore the possibility of nanoscale data storage with high areal density. The role of charge transfer interactions during the OFF to ON transitions and the origin of volatile memory behaviour are further elucidated in conjunction with electrochemical impedance studies (EIS) and theoretical simulations. [ABSTRACT FROM AUTHOR]

Cloud computing is one of today's most popular and important IT trends. Currently, most organizations use cloud computing services (public or private) as part of their computer infrastructure. Virtualization technology is at the core of cloud computing, and virtual resources, such as virtual servers, are commonly used to provide services to the entire organization. Due to their importance and prevalence, virtual servers in an organizational cloud are constantly targeted by cyber-attackers who try to inject malicious code or malware into the server (e.g., ransomware). Many times, server administrators are not aware that the server has been compromised, despite the presence of detection solutions on the server (e.g., antivirus engine). In other cases, the breach is detected after a long period of time when significant damage has already occurred. Thus, detecting that a virtual server has been compromised is extremely important for organizational security. Existing security solutions that are installed on the server (e.g., antivirus) are considered untrusted, since malware (particularly sophisticated ones) can evade them. Moreover, these tools are largely incapable of detecting new unknown malware. Machine learning (ML) methods have been shown to be effective at detecting malware in various domains. In this paper, we present a novel methodology for trusted detection of ransomware in virtual servers on an organization's private cloud. We conducted trusted analysis of volatile memory dumps taken from a virtual machine (memory forensics), using the Volatility framework, and created general descriptive meta-features. We leveraged these meta-features, using machine learning algorithms, for the detection of unknown ransomware in virtual servers. We evaluated our methodology extensively in five comprehensive experiments of increasing difficulty, on two different popular servers (IIS server and an email server). We used a collection of real-world, professional, and notorious ransomware and a collection of legitimate programs. The results show that our methodology is able to detect anomalous states of a virtual machine, as well as the presence of both known and unknown ransomware, obtaining the following results: TPR  = 1, FPR  = 0.052, F-measure  = 0.976, and AUC  = 0.966, using the Random Forest classifier. Finally, we showed that our proposed methodology is also capable of detecting an additional type of malware known as a remote access Trojan (RAT), which is used to attack organizational VMs. [ABSTRACT FROM AUTHOR]

In this work, we report on mimicking the synaptic forgetting process using the volatile mem-capacitive effect of a resistive random access memory (RRAM). TiO dielectric, which is known to show volatile memory operations due to migration of inherent oxygen vacancies, was used to achieve the volatile mem-capacitive effect. By placing the volatile RRAM candidate along with SiO at the gate of a MOS capacitor, a volatile capacitance change resembling the forgetting nature of a human brain is demonstrated. Furthermore, the memory operation in the MOS capacitor does not require a current flow through the gate dielectric indicating the feasibility of obtaining low power memory operations. Thus, the mem-capacitive effect of volatile RRAM candidates can be attractive to the future neuromorphic systems for implementing the forgetting process of a human brain. [ABSTRACT FROM AUTHOR]

In this work, the Al/SiO2/p-Si metal-insulator-semiconductor structures with various metal thicknesses were fabricated. The charging/discharging transient current behaviors during sweeping or switching the voltages have been studied. By thinning down partial portion of the gate metal to 10 nm, the steady state leakage current was found decreased because the high resistivity of the ultrathin metal causing lower fringing field effect. Also, the transient currents were found enhanced. The reasons were that there were minority carriers under the ultrathin metal contributing to the transient currents. The above properties make the device having better volatile memory characteristics. [ABSTRACT FROM PUBLISHER]

The Windows Common Controls is a library which facilitates the construction of GUI controls commonly used by Windows applications. Each control is an extension of the basic ‘window’ class. The difference in the extension results in one control over another; for example, an Edit control as opposed to a Button control. The basic window class is documented by Microsoft and the generic information about a Window can be extracted, but this is of very limited use. There is no documentation and very little research into how these extensions are laid out in memory. This paper demonstrates how the extension bytes for the Edit control can be parsed leading to identification of previously unobtainable data which reveal information about the state of the control at runtime. Most notably, the undo buffer, that is, text that was previously present in the control can be recovered – an aspect which traditional disk forensics would simply not provide. The paper explains why previous attempts to achieve similar goals have failed, and how the technique could be applied to any control from the Windows Common Controls library. [ABSTRACT FROM AUTHOR]