Forensic analysis of Windows 10 compressed memory using Volatility

Memory analysis on Windows 10 is pretty different from previous Windows versions: a new feature, called Memory Compression, make it necessary a forensic tool able to read compressed memory pages.

Continue reading “Forensic analysis of Windows 10 compressed memory using Volatility”