# The Evolution of Volatile Memory Forensics
## 4 Memory Analysis
### Traditional Memory Forensic Approaches
#### 4.2.1. Scanning Methods  
Signature scanning looks to match the signatures of known malware with the contents of memory dump files from infected systems. A signature is a footprint or pattern, typically including byte patterns and strings, that are unique to the malware type. YARA signatures have emerged as the industry de facto method for scanning, and are directly supported in _Volatility_[44]. The YARA matching engine compares a given sample with a large database of signature rule formats that each represent a type of malware or malware family. The following authors have used signature scanning in their memory forensic approaches.  
When evaluating memory with scanning techniques, one can either scan the virtual address space or the memory image directly. [PERSON] [45] proposed a \"context aware\" scanning method that uses the Windows Page Frame Number (PFN) database to rapidly identify the owner of each physical page, and where it is mapped in its virtual addressspace. This method improves the matching speed and accuracy since the virtual address space need not be reconstructed for every process.  
A large obstacle memory forensics techniques face in practice is the amount of storage required to keep a large number of memory dump files. Efforts to create a public repository of memory dump files for the purposes of memory forensics are attempting to address this [46], but we can assume that the storage size will continue to be an issue if malware prevalence continues to increase exponentially. To this end, the use of compression utilities on memory dump files [47], and the creation of signatures based on the compressed memory files, has been considered. However, because malware typically modifies only a small portion of a machine's memory, the majority of data in memory dumps is redundantly stored. [PERSON] and [PERSON] [48] address this with their _MemScrimper_ methodology. This method involves taking a snapshot of the memory of the clean system, taking a memory snapshot after exploding a single malware sample, finding the difference between those snapshots, saving and compressing the difference, reverting to the clean snapshot, and then repeating for each malware sample to be analyzed. Because the large benign portions of the memory dumps are not compressed and saved, this method is even more space efficient than simply using compression utilities.  
Heuristic scanning is a method that detects threats using rules and algorithms to look for commands or instructions that may indicate malicious intent. The heuristic rules are more generalizable than signatures, allowing heuristics to identify previously unseen malware that shares characteristics with previously identified malware. In practice, heuristic scanning and signature scanning are often used in conjunction with each other. Scanning techniques are often significantly faster than sandboxing techniques. A recent heuristic scanning method for memory forensics was made by [PERSON] et al. [49]. Their contribution, the _USIM_ toolkit, is a set of integrity measurement collection tools that look at the abstractions of the operating system and search for violations of invariants that indicate deviation from the expected run-time behavior. Primarily, they examine the abstractions of the namespaces, filesystems, networking and communication channels, environment variables, and runtime linkers/loaders. They also look at abstractions of the virtual memory management. These abstractions are then gathered into a single, graph-based structure, which is appraised by a set of rules defined by the administrator. This toolkit, while a potentially valuable resource for reverse engineers, was not built with the intent to automatically detect the presence of malware, but to allow analysts to better dive deeper into the structure of both memory and non-memory forensic data using rule-based heuristics.