Forensics examination of volatile system data using virtual introspection
a hardware - based memory acquisition procedure for digital investigations .