# The Evolution of Volatile Memory Forensics
## 3 Memory Acquisition
### Discussion  
Of the developed memory acquisition tools, none provide a perfect memory image that is also practical to deploy and maintains complete security. The available tools capable of delivering correct, atomic snapshots with integrity tend to be impractical for performance reasons or because they require the termination of the system. Acquisition tools that have faster, non-terminating performance typically do so at the expense of the atomicity or integrity of the snapshot. However, if the overwritten or evolving memory sections are small enough, it has been argued that the memory snapshots are almost atomic, and  
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Access Level** & **Type** & **Tool Name** & **Pre-Incident** & **Post-Incident** & **Terminating** & **Non-Terminating** \\ \hline \multirow{8}{*}{Kernel Level Level} & Kernel Drivers & \begin{tabular}{l} Primer \\ LiME [15] \\ ProComp [16] \\ \end{tabular} & x & x \\ \cline{2-6}  & \begin{tabular}{l} Crash Dump Files \\ \end{tabular} & Built in & x & x & x \\ \cline{2-6}  & \begin{tabular}{l} Hiberation Files \\ \end{tabular} & Built in & x & x & x \\ \cline{2-6}  & \begin{tabular}{l} Debugers \\ \end{tabular} & \begin{tabular}{l} GNU Project Debugger [19] \\ WinDB [20] \\ Visual Studio [21] \\ \end{tabular} & x & x & x \\ \hline \multirow{8}{*}{Hypervisor Level} & Hypervisor & \begin{tabular}{l} **VMware**[22] \\ LibVMI [23] \\ \end{tabular} & x & & & x \\ \cline{2-6}  & Hypervisor & \begin{tabular}{l} Hypersiteuth [24] \\ Vis [25] \\ [PERSON] et al. [26] \\ \end{tabular} & x & x \\ \cline{2-6}  & System & \begin{tabular}{l} BIOS-level \\ Level \\ \end{tabular} & \begin{tabular}{l} SmmBackdoor [27] \\ \end{tabular} & x & & & x \\ \cline{2-6}  & Direct Memory Access & \begin{tabular}{l} PCILech [28] \\ Inception [29] \\ \end{tabular} & x & x & x \\ \cline{2-6} Asynchronous & \
\begin{tabular}{l} Hardware Thread \\ Control Block \\ \end{tabular} &
\begin{tabular}{l} Snipsnap [30] \\ \end{tabular} & x & & & x \\ \cline{2-6}  & Cold Boot & Built in & x & x & x \\ \hline \hline \end{tabular}
\end{table}
Table 1: A summary of memory acquisition tools according to the taxonomy [4]. An ‘x’ in a column indicates that a tool’s category resides in that classification. An ‘x’ is listed in both the Pre-Incident and Post-Incident column if a category of tools contains examples of both classifications.  
therefore, good enough for most purposes [25]. [PERSON] et al. [12] disagreed, arguing that changes in memory across time and space must be accounted for in order to reasonably use non-atomic snapshots. Another issue that many of the acquisition tools suffer from is vulnerability to anti-forensic methods. Memory acquisition tools executed from the hypervisor level and above can be detected and subverted by malware that can identify the presence of the hypervisor or through other sophisticated techniques [31]. Even straight hardware-based approaches can be compromised by time-based detection from the malware [6]. Acquisition tools that are more resistant to anti-forensic methods tend to have higher levels of page-smearing and thus lower atomicity, because the tool does not interrupt the host. Thus far, tools implemented at the system management level have great promise to meet these competing demands of quality, performance, and security, but more research and development is needed in this area.