A. Arasteh and M. Debbabi, Forensic memory analysis: From stack and code to execution history, Digital Investigation, pp.114-125, 2007.
DOI : 10.1016/j.diin.2007.06.010

G. Balakrishnan and T. Reps, Analyzing memory accesses in x86 executables, Proceedings of the Thirteenth International Conference on Compiler Construction, pp.5-23, 2004.
DOI : 10.21236/ada449077

G. Bugcheck, Grepping executive objects from pool memory (www.uninformed.org, 2006.

M. Burdach, An introduction to Windows memory forensics (forens ic.seccure.net/pdf/introduction to windows memory forensic, 2005.

M. Burdach, Digital forensics of the physical memory (forensic.sec cure.net/pdf/mburdach digital forensics of physical memory, 2005.

M. Burdach, Windows Memory Forensic Toolkit (forensic.seccure .net), 2007.

B. Carrier and J. Grand, A hardware-based memory acquisition procedure for digital investigations, Digital Investigation, pp.50-60, 2004.
DOI : 10.1016/j.diin.2003.12.001

K. Chow, F. Law, M. Kwan, and P. Lai, Consistency issues in live systems forensics, Proceedings of the International Workshop on Forensics for Future Generation Communication Environments, pp.136-140, 2007.

D. Farmer and W. Venema, Forensic Discovery, 2005.

G. Garcia, Forensic physical memory analysis: Overview of tools and techniques, Telecommunications Software and Multimedia Laboratory, 2007.

E. Huebner, D. Bem, F. Henskens, and M. Wallis, Persistent systems techniques in forensic acquisition of memory, Digital Investigation, pp.129-137, 2007.
DOI : 10.1016/j.diin.2008.02.001

N. Petroni, A. Walters, T. Fraser, and W. Arbaugh, FATKit: A framework for the extraction and analysis of digital forensic data from volatile system memory, Digital Investigation, pp.197-210, 2006.
DOI : 10.1016/j.diin.2006.10.001

T. Reps and G. Balakrishnan, Improved Memory-Access Analysis for x86 Executables, Proceedings of the Seventeenth International Conference on Compiler Construction, pp.16-35, 2008.
DOI : 10.1007/978-3-540-78791-4_2
URL : http://www.cs.wisc.edu/wpis/papers/etaps08.invited.pdf

A. Schuster, Searching for processes and threads in Microsoft Windows memory dumps, Digital Investigation, pp.10-16, 2006.
DOI : 10.1016/j.diin.2006.06.010

I. Sutherland, J. Evans, T. Tryfonas, and A. Blyth, Acquiring volatile operating system data tools and techniques, ACM SIGOPS Operating Systems Review, vol.42, issue.3, pp.65-73, 2008.
DOI : 10.1145/1368506.1368516

R. Van-baar, W. Alink, and A. Van-ballegooij, Forensic memory analysis: Files mapped in memory, Digital Investigation, pp.52-57, 2008.
DOI : 10.1016/j.diin.2008.05.014