Matt Suiche
More info
- Known for
- Windows memory forensics, DumpIt, MoonSols, Comae
French memory-forensics researcher who showed that Windows hibernation writes a complete copy of RAM to disk, readable by anyone who knows the format.
In 2008 Suiche published Sandman, which decoded the Windows hibernation file hiberfil.sys. The file holds compressed memory as it stood at sleep time — processes, network connections, sometimes keys — and so became a fresh source of evidence for digital forensics. It is the same lesson as the cold boot attack: whatever lives in memory ends up somewhere else sooner or later.
He founded MoonSols, whose free DumpIt tool became the standard double-click way to capture memory on a Windows box, and later Comae Technologies, acquired by Magnet Forensics in 2022. In 2017 he was among the first to argue that NotPetya was not ransomware at all but a wiper in disguise.