Towards Classifying File Segments in Memory Using Machine-Learning

Abstract

Digital media triage is a main challenge that faces a digital investigator. Knowing what might be useful during crime investigation could greatly save the investigator’s time and enhance outcomes. Memory investigation can get potential benefit from the triage process because of its scattered and diverse contents. The Operating System’s paging scheme might map the contents of a file into non-consecutive page frames in the physical memory, making the file-type classification and identification process harder. This paper tackles the memory content triage problem at the page level using a machine-learning methodology.