TRESOR Runs Encryption Securely Outside RAM
a hardware - based memory acquisition procedure for digital investigations .