This problem is isomorphic to the antivirus problem. You can't even trust the memory controller to tell you the truth about live memory contents. When you compare Decaf to, say, a modern rootkit, it's apparent how superficial this forensics conflict really is.