Improving Memory Forensics Through Emulation and Program Analysis