Characterizing Data Structures for Volatile Forensics
Mapping kernel objects to enable systematic integrity checking