On classifying memory contents at page-level granularity: machine-learning approach

A significant challenge faced by digital investigators in the realm of law is performing digital media triage, which involves determining the relevant data that may aid in a criminal investigation. Effective triage can save time and improve investigative outcomes, particularly in memory investigation, as its contents are often scattered and diverse. Identifying and classifying file types in memory can be difficult due to the way the operating system's paging scheme maps file contents into non-consecutive page frames in physical memory. This paper presents a machine learning approach to triage memory content at the page level, focusing on the classification of common file types within the context of law. The study conducted various experiments, and the results indicate that it is possible to accurately classify in-memory data into primary file categories, thus contributing to the field of digital investigation in accordance with legal processes.