http://strony.aster.pl/forensics/pdf/mburdach_physical_memory_forensics_bh06.pdf