Heap Inspector

Heap Inspector™ allows an investigator to visualize and search data stored in application heap memory. This is a simple yet extremely powerful ability, particularly in the context of host-level forensics. I will discuss two specific use cases: detecting heap spray attacks (post-mortem) and searching for personally identifiable information (PII).