Abstract
Many security and forensic analyses rely on the ability to fetch memory snapshots from a target machine. To date, the security community has relied on virtualization, external hardware or trusted hardware to obtain such snapshots. We show that these prior techniques either sacrifice snapshot consistency or impose a performance penalty on applications executing atop the target. We present a new snapshot acquisition system based on emerging 3D-stacked architectures that offers snapshot consistency without impacting the performance of the target’s applications. We have implemented our system in a hardware simulation infrastructure and report on our evaluation with several data intensive workloads.