« ManagementBits update (February, 2009)
Busy system, blocked threads, wait chains and deadlock: pattern cooperation »

Pattern-Driven Memory Analysis (Part 1)

Last week I had an opportunity to present a pattern-driven memory dump analysis methodology at a global engineering conference. Now in a series of articles I’m going to clarify certain points and extend it to wider domain of memory analysis including computer memory forensics and intelligence.

Today I post the reworked picture of a waterfall-like analysis process:

 

Various phases and their relationship will be discussed in subsequent parts together with examples. 

- Dmitry Vostokov @ DumpAnalysis.org -

This entry was posted on Monday, March 2nd, 2009 at 4:10 pm and is filed under Citrix, Crash Dump Analysis, Crash Dump Patterns, Debugging, Debugging Methodology, Memory Analysis Forensics and Intelligence, Security, Software Technical Support, Troubleshooting Methodology, WinDbg Scripts. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

2 Responses to “Pattern-Driven Memory Analysis (Part 1)”

  1. Crash Dump Analysis » Blog Archive » Pattern-Driven Memory Analysis (Part 2) Says:
    April 21st, 2009 at 3:57 pm

    […] - 2020 (0×7E4) The Debugging DecadeBefore we explain stages of the analysis process shown in Part 1, let’s start with a brief overview of memory dumps, debuggers and logs. Recall that a memory dump […]

  2. Crash Dump Analysis » Blog Archive » Pattern-Driven Memory Analysis (Part 3) Says:
    May 14th, 2009 at 11:06 am

    […] Therefore we start with the first step in our analysis process diagram introduced in Part 1: […]

Leave a Reply

You must be logged in to post a comment.