1. A method to determine whether a computer system has been compromised, the method comprising the steps of: traversing a virtual address descriptor to acquire complete process data; and reconstructing mapped binary data based on the acquired complete process data.