Abstract The Windows Subsystem for Linux (WSL) was first included in the Anniversary
Update of Microsoft's Windows 10 operating system and supports execution of native Linux
applications within the host operating system. This integrated support of Linux executables
in a Windows environment presents challenges to existing memory forensics frameworks,
such as Volatility, that are designed to only support one operating system type per analysis
task (eg, execution of a single framework plugin). WSL breaks this analysis model as Linux …