Главная
Study mode:
on
1
Intro
2
Memory Forensics - Why?
3
Memory Acquisition Options
4
Typical Address Space Layout
5
Memory Acquisition via Software: Tools
6
Memory Analysis Goals
7
Memory Analysis Techniques
8
Enumerate Processes
9
Review Network Artifacts
10
Extract Files from Memory
11
Windows 10 Memory Compression
12
Memory Compression & Forensics
13
Windows 10 VSM
14
Traditional Architecture
15
Malware in Secure Mode?
16
VSM and Memory Forensics
17
VSM and Memory Acquisition
18
Recap: Changes in Windows 10
19
Questions?
Description:
Explore the current state of memory forensics in this 46-minute conference talk from Louisville InfoSec 2016. Delve into the importance of memory forensics, various memory acquisition options, and typical address space layouts. Learn about software tools for memory acquisition and understand key memory analysis goals and techniques. Discover how to enumerate processes, review network artifacts, and extract files from memory. Examine Windows 10 memory compression and its impact on forensics, as well as the implications of Windows 10 VSM (Virtual Secure Mode) for traditional architecture and malware detection. Gain insights into VSM's effects on memory forensics and acquisition processes. Conclude with a recap of changes in Windows 10 and participate in a Q&A session to deepen your understanding of memory forensics in modern operating systems.

Technical A02 - The Current State of Memory Forensics

Add to list