Home Science Memory forensics and the Windows Subsystem for Linux

Memory forensics and the Windows Subsystem for Linux


The Windows Subsystem for Linux (WSL) was first included in the Anniversary Update of Microsoft’s Windows 10 operating system and supports execution of native Linux applications within the host operating system. This integrated support of Linux executables in a Windows environment presents challenges to existing memory forensics frameworks, such as Volatility, that are designed to only support one operating system type per analysis task (e.g., execution of a single framework plugin). WSL breaks this analysis model as Linux forensic artifacts, such as ELF executables, are active in a sample of physical memory from a system running Windows. Furthermore, WSL integrates Linux-specific data structures into existing Windows data structures, such as those used to track per-process metadata as well as userland runtime data. This integration results in existing analysis plugins producing inconsistent results when analyzing native Windows processes compared to WSL processes. Further complicating this situation is the fact that much of the WSL subsystem internals are completely undocumented. To remedy the current deficiencies related to WSL analysis, a research effort was undertaken to understand which existing Volatility plugins are affected by the introduction of WSL as well as what updates are necessary to fully support memory forensics of WSL. This paper describes these efforts, including our study of the operating systems data structures relevant to WSL as well as the development of new Volatility analysis plugins.

Load More Related Articles
Load More In Science


  1. 1expenditure

    December 31, 2021 at 12:56 am


  2. adam for adam gay dating

    January 2, 2022 at 1:40 pm

    how much is membership for gay dating sites https://gay-buddies.com

  3. facebook gay dating group

    January 2, 2022 at 2:39 pm

    gay dating sites black dating white https://gayprideusa.com

  4. gay perv chat

    January 14, 2022 at 7:07 pm

    amature gay video chat https://gaytgpost.com/

  5. gay nude video chat

    January 14, 2022 at 7:46 pm

    men 4 you gay chat https://gay-buddies.com/

  6. adam for adam gay online dating https://speedgaydate.com/