{"id":82,"date":"2020-02-27T21:11:28","date_gmt":"2020-02-27T21:11:28","guid":{"rendered":"https:\/\/reversea.me\/?page_id=82"},"modified":"2020-03-23T10:38:09","modified_gmt":"2020-03-23T10:38:09","slug":"publications","status":"publish","type":"page","link":"https:\/\/reversea.me\/index.php\/research\/publications\/","title":{"rendered":"Publications"},"content":{"rendered":"Reading Time: <\/span> < 1<\/span> minute<\/span><\/span>\n
<\/a>
\r\n
68 entries<\/span> «<\/a> ‹<\/a> 1 of 5 ›<\/a> »<\/a> <\/div><\/div>

Uroz, Daniel; Pinilla, Abraham D\u00edaz-Campo; Rodr\u00edguez, Ricardo J.<\/p>

Structural Analysis of the Windows NT Heap for Memory Forensics<\/a> Journal Article<\/span> <\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. PP, <\/span>no. PP, <\/span>pp. PP, <\/span>2026<\/span>, ISSN: 2666-2817<\/span>, (Selected Papers of the Thirdteenth Annual DFRWS Europe Conference. Accepted for publication. To appear.)<\/span>.<\/p>

Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span> | Tags: <\/span>Heap Forensics<\/a>, Low Fragmentation Heap<\/a>, memory forensics<\/a>, Volatility 3<\/a>, Windows NT Heap<\/a><\/p>

@article{Uroz2026,
\r\ntitle = {Structural Analysis of the Windows NT Heap for Memory Forensics},
\r\nauthor = {Daniel Uroz and Abraham D\u00edaz-Campo Pinilla and Ricardo J. Rodr\u00edguez},
\r\nurl = {https:\/\/webdiis.unizar.es\/~ricardo\/files\/papers\/UrozDR-FSIDI-26.pdf},
\r\nissn = {2666-2817},
\r\nyear  = {2026},
\r\ndate = {2026-03-01},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {PP},
\r\nnumber = {PP},
\r\npages = {PP},
\r\nabstract = {Modern attacks increasingly target user-space memory, leveraging dynamic heap allocations to store payloads, obfuscate runtime behavior, and evade traditional detection mechanisms. These heap-based techniques complicate memory forensics, as existing tools typically treat dynamic memory as a flat, unstructured region. To address this gap, in this paper we present a forensic methodology for the extraction and structural analysis of Windows NT heap entries, implemented in an open-source plugin for the Volatility 3 framework, called tt HeapList. Our approach supports all major Windows versions, from Vista to Windows 11, on both x86 and x64 architectures. We reconstruct the backend and frontend heap layers, decode encoded metadata, and enable navigation and directed extraction of heap entries. We validate our methodology through cross-verification with tt WinDbg and controlled testing using the Windows Heap API. Additionally, we discuss how our plugin can facilitate reverse engineering, the identification of dynamic payloads, heap layout inspection, and memory triage. By providing structured access to user-space heap memory, our work improves forensic visibility into dynamic memory and enables deeper analysis of heap-centric behavior in modern threat landscapes. Finally, we demonstrate the applicability of our approach in real-world scenarios by extracting information relevant to forensic analysis of user-space applications (specifically, from Telegram Desktop) through heap analysis.},
\r\nnote = {Selected Papers of the Thirdteenth Annual DFRWS Europe Conference. Accepted for publication. To appear.},
\r\nkeywords = {Heap Forensics, Low Fragmentation Heap, memory forensics, Volatility 3, Windows NT Heap},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Modern attacks increasingly target user-space memory, leveraging dynamic heap allocations to store payloads, obfuscate runtime behavior, and evade traditional detection mechanisms. These heap-based techniques complicate memory forensics, as existing tools typically treat dynamic memory as a flat, unstructured region. To address this gap, in this paper we present a forensic methodology for the extraction and structural analysis of Windows NT heap entries, implemented in an open-source plugin for the Volatility 3 framework, called tt HeapList. Our approach supports all major Windows versions, from Vista to Windows 11, on both x86 and x64 architectures. We reconstruct the backend and frontend heap layers, decode encoded metadata, and enable navigation and directed extraction of heap entries. We validate our methodology through cross-verification with tt WinDbg and controlled testing using the Windows Heap API. Additionally, we discuss how our plugin can facilitate reverse engineering, the identification of dynamic payloads, heap layout inspection, and memory triage. By providing structured access to user-space heap memory, our work improves forensic visibility into dynamic memory and enables deeper analysis of heap-centric behavior in modern threat landscapes. Finally, we demonstrate the applicability of our approach in real-world scenarios by extracting information relevant to forensic analysis of user-space applications (specifically, from Telegram Desktop) through heap analysis.<\/div>
Close<\/a><\/p><\/div>