Fraunhofer Institute for Communication, Information Processing and Ergonomics

Memory Slice: A Process-Centric Dump Format for Differential Memory Analysis and Volatility 3 Plugin Synthesis

System-centric memory forensics requires kernel-specific symbols and types, delaying analysis when no matching profile is available. Process-level dumps avoid full-system acquisition but typically omit OS-queryable context available only while the process is live. We present Memo...

Bounty Hunter: Autonomous, Comprehensive Emulation of Multi-Faceted Adversaries

Adversary emulation is an essential procedure for cybersecurity assessments such as evaluating an organization’s security posture or facilitating structured training and research in dedicated environments. To allow for systematic and time-efficient assessments, several approaches...

Foundations for Investigations of Agentic AI Systems from the Forensic Analysis of OpenClaw

Agentic AI systems are increasingly deployed as personal assistants and virtual employees, and are likely to become a common object of digital investigations and incident response. Yet little is known about how their internal state and actions can be reconstructed during forensic...