Blog: SANS Digital Forensics and Incident Response Blog: Category - Volatility

Blog: SANS Digital Forensics and Incident Response Blog:

#FOR526 #MemoryForensics Course - Special Deal for Online Training and Capital City in July

FOR526 - 10% Off for vLive (Online Live Training)orCapital City in July. Use code = m3mory


Memory Forensics



FOR526 - 10% Off forvLive(Online Live Training)orCapital City in July. Use code = m3mory

Getting Started with Linux Memory Forensics

Like many of you, I have been watching the development of memory forensics over the last two years with a sense of awe. It is amazing how far the field has come since the day Chris Betz, George Garner and Robert-Jan Moral won the 2005 DFRWS forensics challenge. Of course, similar to other forensic niches, the majority of progress has been made on Windows memory forensics. There is good reason for this. Memory can be extremely fickle, with layouts and structures changing on a whim. As an example, the symbols file for Windows 7 SP1x86 is 330MB, largely due to it needing to support major changes that can occur in every service pack and patch. The fact that we have free tools such as Volatile Systems Volatilityand Mandiant

...