http://strony.aster.pl/forensics/pdf/introduction_to_windows_memory_forensic.pdf