Forensic analysis of WIndows physical memory