We are excited to announce the release of Memory Analysis 0.9 package, a significant milestone that introduces support for extracting GUI artifacts.
All features have been thoroughly tested across Windows versions from XP through Windows 11, on both x86 and x64 architectures. This, for instance, is the latest version of Windows 11.
Windows
We introduced the ability to inspect desktops and their associated windows.
Selecting a desktop displays a detailed list of its windows, including key attributes such as callbacks, visibility status, styles, and additional information.
To further enhance analysis, we also generate a visual preview of each desktop based on the available information.
Clipboard
The new clipboard extraction capability allows investigators to recover clipboard contents, including on the latest Windows 11 systems.
Clipboard data often contains critical user interactions and transient information that may not be stored elsewhere, making this feature particularly valuable for forensic investigations.