Accelerating volatile memory forensics for bare-metal malware analysis with FPGA devices

• Design of a hardware architecture for high-speed volatile memory acquisition and real-time forensic artifact scanning on FPGA devices. • Development of an efficient FPGA-based method for detecting active and terminated processes on Windows 10 through direct physical memory scanning. • Proof-of-concept evaluation demonstrating significant speed improvements over traditional forensic tools. • Analysis of system limitations and applicability in both laboratory and real-world environments. Modern malware often employs anti-analysis techniques to detect virtualized or emulated environments, evading traditional dynamic analysis systems. To address this challenge, bare-metal analysis platforms have emerged as a more transparent alternative. However, efficiently monitoring them while preserving transparency and minimizing interference remains a key challenge. In this paper, we present a proof-of-concept hardware accelerator implemented on an FPGA device, designed for high-speed volatile memory acquisition and on-the-fly pool tag scanning of the memory content to extract information about active and terminated processes on a bare-metal malware execution system running Windows 10. The memory forensics accelerator leverages PCIe-based DMA to acquire the volatile memory from the monitored system and performs the scanning for process structures directly on the FPGA, without requiring any software installation on the monitored system. Our approach improves transparency and isolation, and shows significant speed advantages over conventional snapshot-based memory forensics. We evaluate the prototype and discuss its limitations and applicability in malware analysis workflows.