By Andreas Schuster
Copyright © 2009 int for(ensic){blog;}. All rights reserved. Reproduction for commercial purposes (including online advertisement) interdicted.
The Forum of Incident Response and Security Teams (FIRST) is going to held its annual conference from June 28 to July 3, 2009 in Kyoto, Japan. Registration is now open to the interested public.
I'm exited to announce that my half-day tutorial Windows Memory Forensics with Volatility was accepted!
From the abstract:
The analysis of main memory can provide valuable help in incident response and forensic investigations. One of the most promising tools in this field is the Volatility framework. This free and open source software provides analysts with a comprehensive set of commands to enumerate processes, drivers, network connections, and much more. To experienced users, Volatility becomes a programming framework that allows to build custom analysis modules in a little while.
This tutorial will provide the attendees with the fundamentals of memory management on the Microsoft Windows platform. Attendees will learn how to leverage Volatility to uncover malicious system activity. A mapping will be drawn between key concepts of memory management and the core modules of Volatility. Advanced users will write their first simple plug-in during the course.
The presentation aims at forensic examiners and incident responders. Participants should be familiar with the Microsoft Windows platform. No kernel programming skills are required, though some basic knowledge about Windows NT kernel architecture (kernel, threads, scheduler) will be helpful.
Konnichi wa!
