Pages

▼
Showing posts with label memory. Show all posts
Showing posts with label memory. Show all posts
Wednesday, November 20, 2013

Sniper Forensics, Memory Analysis, and Malware Detection

›
I conducted some analysis recently where I used timeline analysis, Volatility, and the Sniper Forensics concepts shared by Chris Pogue to d...
4 comments:
Wednesday, September 07, 2011

Registry Stuff

›
I ran across a tweet recently from Andrew Case (@attrc on Twitter) regarding a Registry key with some interesting entries; specifically, the...
2 comments:
Monday, December 14, 2009

Link-idy link-idy

›
Tools Claus (no, I'm not saying that Claus is a tool...) has posted a nice summary of some of the free tools posts from WindowsIR and...
2 comments:
Friday, March 20, 2009

Memory Analysis, for real!

›
A bit ago, Rich over at HBGary was nice enough to provide me with a dongle for Responder Field Edition , so that I could take a look at it ...
2 comments:
Monday, March 02, 2009

Extreme Coolness

›
Moyix has done it again! Not only has he updated his Volatility modules for retrieving Registry data from memory, but he's also develo...
Tuesday, February 17, 2009

HBGary: FastDump and Responder

›
Thanks to Rich Cummings, I was recently able to take a look at HBGary products that they offer with respect to physical memory collection an...
4 comments:
Sunday, February 01, 2009

Thoughts on memory footprints...

›
I was chatting with a friend the other day, and we got to talking about the issue of the memory footprints of various tools. We agreed on t...
2 comments:
Saturday, January 17, 2009

New and interesting things

›
A couple of very interesting things have come about lately; in particular, Brendan has released some new Volatility modules for extractin...
Tuesday, January 06, 2009

Memory Collection and Analysis Tools

›
Recently, there was a post on the SANS Forensics blog about memory collection and analysis tools , but for some reason, it seems that folks ...
13 comments:
Saturday, December 06, 2008

Windows Hibernation files

›
Matthieu has made his Exploiting Windows Hibernation File presentation available...for anyone interested at all in Windows memory analysis,...
5 comments:
Saturday, August 16, 2008

Volatility 1.3 is out!

›
Volatility 1.3 is out! Volatile Systems (AAron, et al.) improves upon their venerable open-source memory analysis tool with this latest ver...
Sunday, August 03, 2008

The Question of "whodunnit?"

›
One of the questions that comes up from time to time during an examination is "whodunnit?" Take an examination involving, let...
1 comment:
Tuesday, June 17, 2008

Memory Collection and Analysis, part II

›
Based on my last post, I wanted to throw some quick tests together and see how things worked out...here's the results of what I found......
19 comments:
Saturday, June 14, 2008

Memory Collection and Analysis

›
As a follow-on to my previous post regarding OMFW, there have been some developments in the area of memory dumping and parsing (ie, collect...
12 comments:
Thursday, June 05, 2008

Some UpComing Events

›
There are some interesting events coming up this summer (and beyond) that I wanted to point out to folks... DFRWS is this summer (11-13 Aug...
5 comments:
Thursday, February 21, 2008

Important Memory Update

›
I ran across this info today, and thought that I'd post it...it seems quite important, in that it pertains to the use of physical memor...
5 comments:
Thursday, January 31, 2008

Enter Sandman

›
You're probably wondering, "Since when did Metallica have anything to do with Windows forensics?" My answer to that is...sinc...
2 comments:
Tuesday, November 20, 2007

Windows Memory Analysis

›
It's been a while since I've blogged on memory analysis, I know. This is in part due to my work schedule, but it also has a bit to ...
5 comments:
Saturday, July 14, 2007

Thoughts on RAM acquisition

›
As a follow-on to the tool testing posts, I wanted to throw something else out there...specifically, I'll start with a comment I receiv...
7 comments:
Thursday, July 12, 2007

Tool Testing Methodology, Memory

›
In my last post , I described what you'd need to do to set up a system in order to test the effects of a tool we'd use on a system ...
3 comments: