The Study of Text Evidence in Memory

The text message which has been viewed and edited is stored in physical memory. In this paper, we take the notepad process as sample, designs a recovery scheme for user's viewing-data and judge whether the document was edited, First this scheme extracts the data of all notepad's process in memory with the member information of the process's EPROCESS structure, and then, matches the data with the target string, thus, it can recovery the viewing-data of a different order. Experiments show that this scheme can recovery the text message when the user browsing in the last minutes and analyze the behavior of the user.