Now You See Me: Hide and Seek in Physical Address Space
A survey of main memory acquisition and analysis techniques for the windows operating system