Security Incidents mailing list archives
Digital forensics of the physical memory
From: Mariusz Burdach <mariuszburdach () yahoo com>
Date: Wed, 15 Jun 2005 05:56:28 -0700 (PDT)
Hello, I have written a research paper on Digital forensics of the physical memory. This is an introduction to new area of forensics. The objective of this document is to demonstrate methods that the physical memory image from the compromised machine can be analyzed. At the moment, only Linux memory image based on kernel 2.4.x is presented. This how-to paper will try to show ways of enumerating processes, recovering text and executable files, detecting hidden processes, identifying processes executed in the past, correlating data from memory image and swap areas, and so on. Document is available at: http://forensic.seccure.net/pdf/mburdach_digital_forensics_of_physical_memory.pdf I also would like to announce a beta version of idetect toolkit. This toolkit can be very helpful in process of digital investigation of the physical memory. Idetect 0.1 can be obtained here: http://forensic.seccure.net/tools/idetect.tar.gz Reader feedback and constructive criticism is welcome and appreciated. Regards, Mariusz Burdach Mariusz.Burdach[at]seccure[dot]net http://forensic.seccure.net __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail
Current thread:
- Digital forensics of the physical memory Mariusz Burdach (Jun 15)
- Re: Digital forensics of the physical memory Ben Hawkes (Jun 17)
- Re: Digital forensics of the physical memory Mariusz Burdach (Jun 17)
- Re: Digital forensics of the physical memory Harlan Carvey (Jun 17)
- RE: Digital forensics of the physical memory George M. Garner Jr. (Jun 18)
- RE: Digital forensics of the physical memory Harlan Carvey (Jun 20)
- Re: Digital forensics of the physical memory David Pick (Jun 20)
- Moderator's note: Re: Digital forensics of the physical memory Daniel Hanson (Jun 20)
- part deux, was -> RE: Digital forensics of the physical memory Harlan Carvey (Jun 20)
- Re: part deux, was -> RE: Digital forensics of the physical memory Ben Hawkes (Jun 20)
- Re: Digital forensics of the physical memory Ben Hawkes (Jun 17)