Furthermore, processes which were stopped can also
be found in RAM since the computer was not restarted from
the moment when a certain process was shut down, so it is
possible that the process still exists in the memory because its
working environment was not yet assigned to another
process. This shut down processes can be singled out from
RAM and analyzed just like currently active processes
[2][10].