Frankenstein’s RAM: A Simulation Framework for Evaluating Memory Forensic Acquisition Strategies
TL;DR
Frankenstein is presented, a simulation-based framework that synthesizes a memory dump from a time series of atomic, hypervisor-level ground-truth snapshots under a configurable traversal strategy and bandwidth model and proposes novel page-category priority orderings that cut semantic inconsistencies and Hamming distance respectively.
Abstract
Memory forensics relies on acquiring a faithful copy of RAM, yet software-based acquisition is inherently non-atomic: the operating system keeps modifying memory while pages are read, producing inconsistencies known as page smear. Prior work formalized quality criteria and measured such inconsistencies, but how the acquisition strategy, i.e., page order and transfer rate, affects image quality remains unexplored, and no public framework decouples strategy from the acquisition channel. We present Frankenstein, a simulation-based framework that synthesizes a memory dump from a time series of atomic, hypervisor-level ground-truth snapshots under a configurable traversal strategy and bandwidth model. We implement seven strategy–bandwidth combinations and evaluate them across three workloads via Hamming distance and semantic analysis. We find the acquisition strategy considerably affects quality, but, interestingly, no traversal minimizes byte-level distance and structural-semantic inconsistencies at the same time, since pages dominating byte-level change (user mappings, page cache) compete with pointer-rich kernel objects (slab, kernel pages) for the most timely acquisition. We therefore propose novel page-category priority orderings—a structural focus (slab and kernel pages first) and a volatile focus (user and page-cache pages first)—cutting semantic inconsistencies and Hamming distance respectively.