bibdmt.bib

@book{ligh2014art,
  title={The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory},
  author={Ligh, Michael Hale and Case, Andrew and Levy, Jamie and Walters, Aaron},
  year={2014},
  publisher={John Wiley \& Sons}
}

@book{russinovich2012windows,
  title={Windows internals},
  author={Russinovich, Mark E and Solomon, David A and Ionescu, Alex},
  year={2012},
  publisher={Pearson Education}
}

@article{sylve2016pool,
  title={Pool tag quick scanning for windows memory analysis},
  author={Sylve, Joe T and Marziale, Vico and Richard III, Golden G},
  journal={Digital Investigation},
  volume={16},
  pages={S25--S32},
  year={2016},
  publisher={Elsevier}
}

@online{osMarketShare,
  title = {Operating system market share},
  url = {https://gs.statcounter.com/os-market-share/desktop/worldwide},
  year = {2019}
}

@online{windowsShare,
  title = {Windows version market share},
  url = {https://gs.statcounter.com/windows-version-market-share/desktop/worldwide/},
  year = {2019}
}

@online{kdbgEncoded,
  title = {Volatility on windows 8 encoded KDBG},
  url = {https://volatility-labs.blogspot.com/2014/01/the-secret-to-64-bit-windows-8-and-2012.html},
  year = {2016}
}

@online{rekallOnKDBGEncoding,
  title = {ReKall on windows 8 encoded KDBG},
  url = {http://web.rekall-innovations.com/posts/2014-02-21-do-we-need-kdbg.html},
  year = {2014}
}

@article{Carrier02definingdigital,
  author = {Brian Carrier},
  title = {Defining Digital Forensic Examination and Analysis Tools},
  journal = {International Journal of Digital Evidence},
  year = {2002},
  volume = {1},
  pages = {2003}
}

@online{roadmap,
  author = {Gary Palmer},
  title = {A Road Map for Digital Forensic Research},
  year = {2001},
  url = {https://www.dfrws.org/sites/default/files/session-files/a_road_map_for_digital_forensic_research.pdf}
}

@online{hiddenMalwareAndroid,
  title = {More Hidden App Malware Found on Google Play with over 2.1 Million Downloads},
  year = {2019},
  url = {https://www.symantec.com/blogs/threat-intelligence/hidden-adware-google-play}
}

@online{titanium,
  title = {Titanium: the Platinum group strikes again},
  year = {2019},
  url = {https://securelist.com/titanium-the-platinum-group-strikes-again/94961/}
}

@online{microsoft-pdb,
  title = {microsoft-pdb},
  url = {https://github.com/microsoft/microsoft-pdb},
  year = {2016}
}

@online{pdb-downloader,
  title = {pdb-downloader},
  url = {https://blogs.msdn.microsoft.com/webtopics/2016/03/07/pdb-downloader/},
  author = {Rajkumar Rangaraj},
  year = {2016}
}

@online{yararules,
  title = {Explained: YARA rules},
  author = {Pieter Arntz},
  url = {https://blog.malwarebytes.com/security-world/technology/2017/09/explained-yara-rules/},
  year = {2017}
}

@article{windowsKernelCharacterization,
  author = {Cohen, Michael},
  year = {2015},
  month = {03},
  pages = {},
  title = {Characterization of the windows kernel version variability for accurate memory analysis},
  volume = {12},
  journal = {Digital Investigation},
  doi = {10.1016/j.diin.2015.01.009}
}

@online{GeoffChappell,
  author = {Geoff Chappell},
  title = {Kernel-Mode Windows},
  url = {https://www.geoffchappell.com/studies/windows/km/index.htm},
  year = {2019}
}

@online{nirsoft,
  author = {},
  title = {Nirsoft Windows kernel struct},
  url = {http://www.nirsoft.net/},
  year = {2019}
}

@online{reactos,
  author = {ReactOS Team},
  title = {ReactOS source code},
  url = {https://reactos.org/},
  year = {2019}
}

@online{windowsMalwareStat,
  title = {Operating systems most affected by malware as of 1st quarter 2019},
  url = {https://www.statista.com/statistics/680943/malware-os-distribution/},
  year = {2019}
}

@article{volatools,
  author = {Walters, Aaron and Petroni, Nick},
  year = {2007},
  month = {01},
  pages = {},
  title = {Volatools: Integrating volatile memory forensics into the digital investigation process},
  journal = {Digital Investigation},
  url = {https://www.blackhat.com/presentations/bh-dc-07/Walters/Paper/bh-dc-07-Walters-WP.pdf}
}

@article{reviewLive,
  author = {Rahman, Shuaibur and Khan, M.},
  year = {2015},
  month = {02},
  pages = {379-388},
  title = {Review of Live Forensic Analysis Techniques},
  volume = {8},
  journal = {International Journal of Hybrid Information Technology},
  doi = {10.14257/ijhit.2015.8.2.35}
}

@article{comparativeLive,
  author = {Aljaedi, Amer and Lindskog, Dale and Zavarsky, Pavol and Ruhl, Ron and Almari, Fares},
  year = {2011},
  month = {10},
  pages = {1253-1258},
  title = {Comparative Analysis of Volatile Memory Forensics: Live Response vs. Memory Imaging},
  doi = {10.1109/PASSAT/SocialCom.2011.68}
}

@online{memorylimit,
  title = {Memory Limits for Windows and Windows Server Releases},
  url = {https://docs.microsoft.com/en-us/windows/win32/memory/memory-limits-for-windows-releases},
  year = {2018}
}

@online{dmpfile,
  author = {Andreas Schuster},
  title = {DMP File Structure},
  url = {https://computer.forensikblog.de/en/2006/03/dmp-file-structure.html},
  year = {2006}
}

@online{mdmpfile,
  title = {Minidump (MDMP) format},
  url = {https://github.com/libyal/libmdmp/blob/master/documentation/Minidump (MDMP) format.asciidoc},
  author = {Joachim Metz},
  year = {2017}
}

@article{coldboot,
  author = {Halderman, J. and Schoen, Seth and Heninger, Nadia and Clarkson, William and Paul, William and Calandrino, Joseph and Feldman, Ariel and Appelbaum, Jacob and Felten, Edward},
  year = {2008},
  month = {01},
  pages = {45-60},
  title = {Lest We Remember: Cold Boot Attacks on Encryption Keys}
}

@article{pooltagscan,
  author = {Schuster, Andreas},
  year = {2006},
  month = {01},
  pages = {104-115},
  title = {Pool Allocations as an Information Source in Windows Memory Forensics},
  journal = {IMF}
}

@article{evolutionHidding,
  author = {Eresheim, Sebastian and Luh, Robert and Schrittwieser, Sebastian},
  year = {2017},
  month = {09},
  pages = {866-874},
  title = {The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures},
  volume = {25},
  journal = {Journal of Information Processing},
  doi = {10.2197/ipsjjip.25.866}
}

@online{processdump,
  author = {Geoff McDonald},
  title = {Process-Dump}
  url = {https://github.com/glmcdona/Process-Dump},
  year = {2019}
}

@online{memtriage,
  author = {Jamie Levy},
  title = {memtriage},
  url = {https://github.com/gleeda/memtriage},
  year = {2019}
}

@online{rekall,
  author = {Google},
  title = {Rekall},
  url = {http://www.rekall-forensic.com/},
  year = {2019}
}

@online{volatility,
  author = {Volatility Foundation},
  title = {Volatility},
  url = {https://www.volatilityfoundation.org/},
  year = {2018}
}

@online{sysinternal,
  author = {Mark Russinovich},
  title = {Sysinternals Suite},
  url = {https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite},
  year = {2019}
}

@online{unioncrypto,
  author = {Patrick Wardle},
  title = {Lazarus goes "fileless"},
  url = {https://objective-see.com/blog/blog_0x51.html},
  year = {2019}
}

@online{vergilius,
  author = {Svitlana Storchak and Sergey Podobry},
  title = {Vergilius project},
  url = {https://www.vergiliusproject.com/},
  year = {2019}
}

@online{processinjection,
  author = {Amit Klein, Itzik Kotler},
  title = {Windows Process Injection in 2019},
  url = {https://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf},
  year = {2019}
}