Degree

Doctor of Philosophy (PhD)

Department

Division of Computer Science & Engineering

Document Type

Dissertation

Abstract

Volatile memory holds evidence that reaches persistent storage rarely or never. Containers and robots destroy that evidence as a matter of routine operation rather than through adversarial action, and memory forensic tooling was built for neither platform. This dissertation develops and evaluates a memory-centered approach spanning acquisition, analysis efficiency, and robot forensics, and demonstrates that volatile evidence can be reliably preserved and analyzed at scale across containers and ROS-based robots.

First, we measure why memory forensic analysis is slow. Benchmarking the Volatility Framework across four Python runtimes on 14 memory samples totaling 173 GB shows that PyPy is 15 to 20 percent faster than CPython while producing identical output. That result bounds what runtime substitution can achieve and identifies the language itself as the constraint.

Next, we establish that container checkpoints are forensically usable. We contribute ConPoint, a tool that acquires checkpoints across container engines and low-level runtimes. Across 45 checkpoints spanning three database workloads the mean service interruption is 0.537 seconds, and recovered evidence persists for hours before decaying, disappearing entirely when the container stops.

We then migrate 38 Volatility plugins to Rust using language model assistance, producing 29,028 lines of code in 68 hours. A parity method based on canonical output hashing classifies all 417 plugin-sample pairs. The Rust implementation achieves a median speedup of 2.50x with a peak of 210x, and completes every run while the Python reference fails 47 times.

Applying that toolchain to robots, process-scoped carving of ROS memory reduces false positives twentyfold against whole-dump scanning. We reconstruct 2,332 distinct robot poses on ROS1 and 3,309 on ROS2 from memory alone, and show that the two ROS generations require different forensic strategies.

Finally, we present HuFR, a framework that correlates kernel events, actuator telemetry, and middleware activity on a humanoid robot. Across five sessions HuFR recorded 25,145 messages where post-incident memory analysis recovered 2 partial messages, establishing the case for forensic readiness on robotic platforms

Date

9-17-2026

Committee Chair

Ibrahim Baggili

LSU Acknowledgement

1

LSU Accessibility Acknowledgment

1

Download

Share

COinS