JISE

Retrieving user activities from an application’s volatile memory has traditionally been a labor-intensive process, impeded by the sheer volume of data and the opacity of modern data structures. This paper introduces RAM-Weaver, a novel two-stage framework that enables high-fidelity and contextual reconstruction of user activity from memory dumps. The framework first employs an Adaptive Memory Carver (AMC), a specialized preprocessing module that distills essential information from raw memory. This distillation stage reduces data volume by over 96.89% and improves the signal-to-noise ratio by up to 36.80 dB, making subsequent analysis feasible. The filtered artifacts are then processed by a Large Language Model (LLM), which reconstructs fragmented text with high accuracy and supports interactive, natural language-based forensic queries. Our comprehensive evaluation on diverse real-world messaging applications demonstrates that RAM-Weaver can achieve perfect restoration (100% EMR) under semi-structured data conditions and delivers robust recovery rates of up to 70% even in highly noisy, unstructured environments. By shifting the paradigm from manual string matching to automated contextual reasoning, RAM-Weaver provides a robust and extensible solution for modern memory forensics.