I’m happy to announce the publication of the paper
Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files
at this years DFRWS USA, and the release of the corresponding
volatility plugin.
With this research came also an update to the Ptenum family (affecting
especially the ptemalfind plugin), which makes the plugins reliable in
identifying modified pages despite memory combining, so make sure to grab the
newest version from the Github repository.