Is Memory Dump Analysis a Science?
Based on John Moore 8 science criteria we can consider Memory Dump Analysis (MDA) as a science:
1. MDA is based on data (memory dumps) collected in the field or re-pro / test environment.
2. Data (memory dumps) is collected to answer troubleshooting, debugging or forensics and intelligence questions. Observations in memory dumps are made to support or refute these questions.
3. Analysis of data (via memory dump analyzers, debuggers and log analyzers) is done objectively.
4. Troubleshooting, debugging or forensics hypotheses are developed and they are consistent with observations and compatible with general conceptual computer memory framework.
5. Troubleshooting, debugging or forensics hypotheses are tested and several comparable competing ones may be developed at any one time.
6. Generalizations are made that are valid universally within the domain of MDA.
7. The facts are confirmed independently.
8. Previously puzzling facts are explained.
It is also interesting to generalize the domain of MDA to empirical data collection via the so called universal memory dumps.
- Dmitry Vostokov @ DumpAnalysis.org -