Memory Slice: A Process-Centric Dump Format for Differential Memory Analysis and Volatility 3 Plugin Synthesis

Abstract

System-centric memory forensics requires kernel-specific symbols and types, delaying analysis when no matching profile is available. Process-level dumps avoid full-system acquisition but typically omit OS-queryable context available only while the process is live. We present Memory Slice ( .msl ), a self-describing process-memory format that records captured pages together with module, region, file-descriptor, and network-connection metadata. It provides a three-state per-page acquisition model, hash-chain integrity, and optional authenticated encryption with post-quantum key encapsulation. The preserved metadata enables cross-session differential analysis across \(N{>}2\) independent executions. On TLS 1.3 keys from three libraries, the classifier achieves 100% recall while substantially reducing the search space. In a gocryptfs case study, it localizes the master key—using an analyst-supplied decryption oracle to verify candidates—and derives a memory pattern around it, and from that pattern we synthesize a Volatility 3 plugin that recovers the key from an independently acquired full-system image. We release the specification, MemSlicer , and MemDiver as open source.