Systems, methods and devices for memory analysis and visualization

A method for aiding cyber intrusion investigations, the method comprising:

• extracting data from a specified range of a volatile memory of a target processing device;
• reconstructing data structures and artifacts from the extracted data;
• and
• generating and presenting a visualization of the reconstructed data structures and the reconstructed artifacts, in the form of at least one of a table layout, a tree layout, a graph layout, and/or a cross-view layout, to assess the condition of the target processing device;
• and
• providing a plurality of analysis methods for evaluating a state of the target processing device, the plurality of analysis methods performing at least one of determining differences from a known good state, detecting indications of known attacker activity, detecting indications of malware being present, detecting heuristics associated with suspicious activity, detecting discrepancies in logical relationships among the reconstructed artifacts, and determining whether policies or standards have been violated;
• wherein the method is performed by at least one processing device.