Extracting forensically relevant information from windows application

In this paper, we present the method of investigating and extracting forensically relevant information from the physical memory of Windows systems. This approach revealed the extracted evidence dispersed in the physical memory of an application. The result shows a coherent view of user input on applications with over 96% of user input stored on Word and 94% in PowerPoint. The mean value of the user input found, the user input repeated in the memory and the user input found in continuous blocks will be presented.