Paging

  • provides the ability to virtualize a linear address space.

  • creates an execution environment in which a large linear address space is simulated with a modest amount of physical memory and disk storage.

  • typical page size is 4 kB.

  • different paging structures are used for different processes.

    • the OS provides each process the appearance of a single-programmed environment through a virtualized linear address space.

Address translation to a 4 kB page using 32-bit paging

Impact on memory forensics.

  • Forensics software must emulate the virtual address space and transparently handle virtual-to-physical- address translation.

Last updated