Paging

• provides the ability to virtualize a linear address space.

• creates an execution environment in which a large linear address space is simulated with a modest amount of physical memory and disk storage.

• typical page size is 4 kB.

• different paging structures are used for different processes.

  • the OS provides each process the appearance of a single-programmed environment through a virtualized linear address space.

Address translation to a 4 kB page using 32-bit paging

Impact on memory forensics.

• Forensics software must emulate the virtual address space and transparently handle virtual-to-physical- address translation.