Memory Slice: A Process-Centric Dump Format for Differential Memory Analysis and Volatility 3 Plugin Synthesis
Year: 2026
Type: article
Abstract: System-centric memory forensics requires kernel-specific symbols and types, delaying analysis when no matching profile is available. Process-level dumps avoid full-system acquisition but typically omit OS-queryable context available only while the process is live. We present Memory Slice ( .msl ), a self-describing process-memory format that records captured pages together with module, region, file-descriptor, and network-connection metadata. It provides a three-state per-page acquisition model, hash-chain integrity, and optional authenticated encryption with post-quantum key encapsulation. The preserved metadata enables cross-session differential analysis across \(N{>}2\) independent executions. On TLS 1.3 keys from three libraries, the classifier achieves 100% recall while substantially reducing the search space. In a gocryptfs case study, it localizes the master key—using an analyst-supplied decryption oracle to verify candidates—and derives a memory pattern around it, and from that pattern we synthesize a Volatility 3 plugin that recovers the key from an independently acquired full-system image. We release the specification, MemSlicer , and MemDiver as open source.
DOI: 10.1145/3848418
Authors: Daniel Baier, Martin Lambertz
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7221443568