Digital Forensics Using Memory and File-System Analysis: A Critical Review of Acquisition, Arte-fact Analysis and Correlation Techniques, with a Conceptual Integrated Architecture

Evidence on a computer lives in two broad places. Volatile memory (RAM) captures what the system is doing right now, while persistent storage, through its file system, keeps a long-running record of what was created, edited, moved and erased. RAM can hold running processes, open network connections, loaded modules, injected code, credentials and encryption keys, much of which never touches the disk. File systems, in turn, hold files, metadata, journals, timestamps and traces of deleted content. This paper is a structured narrative review of 26 sources (standards, books and peer-reviewed studies) grouped under six themes: forensic principles and process models; memory acquisition; memory analysis and artefact recovery; file-system analysis, carving and timelines; solid-state storage and anti-forensics; and scale and tool validation. The literature shows that memory analysis can uncover hidden processes, injected code and key material that a disk examination would miss, whereas file-system analysis rebuilds history and recovers deleted content that memory cannot offer. It also shows that acquisition itself introduces error, because capturing memory changes the machine being captured. Yet the two sources are mostly studied apart, acquisition tools can be evaded or may yield inconsistent images, SSD wear-levelling and TRIM weaken the assumptions behind classical recovery, and growing data volumes are overwhelming manual workflows. The review offers a thematic synthesis, a comparison of twelve representative studies, a conceptual seven-layer architecture that correlates memory and file-system evidence within an integrity-preserving workflow, and a prioritised research agenda.