The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory
- 14h 13m
- AAron Walters, Andrew Case, Jamie Levy, Michael Hale-Ligh
- John Wiley & Sons (US)
- 2014
Memory forensics is the art of analyzing computer memory (RAM) to solve digital crimes. As a follow-up to the best seller Malware Analyst's Cookbook, experts in the fields of malware, security, and digital forensics bring you a step-by-step guide to memory forensics—now the most sought after skill in the digital forensics and incident response fields.
Beginning with introductory concepts and moving toward the advanced, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory is based on a five day training course that the authors have presented to hundreds of students. It is the only book on the market that focuses exclusively on memory forensics and how to deploy such techniques properly. Discover memory forensics techniques:
- How volatile memory analysis improves digital investigations
- Proper investigative steps for detecting stealth malware and advanced threats
- How to use free, open source tools for conducting thorough memory forensics
- Ways to acquire memory from suspect systems in a forensically sound manner
The next era of malware and security breaches are more sophisticated and targeted, and the volatile memory of a computer is often overlooked or destroyed as part of the incident response process. The Art of Memory Forensics explains the latest technological innovations in digital forensics to help bridge this gap. It covers the most popular and recently released versions of Windows, Linux, and Mac, including both the 32 and 64-bit editions.
About the Authors
Michael Hale-Ligh is author of Malware Analyst's Cookbook, Secretary/Treasurer of Volatility Foundation, and a world-class reverse engineer.
Andrew Case is a Digital Forensics Researcher specializing in memory, disk, and network forensics.
Jamie Levy is a Senior Researcher and Developer, targeting memory, network, and malware forensics analysis.
AAron Walters is founder and lead developer of the Volatility Project, President of the Volatility Foundation, and Chair of Open Memory Forensics Workshop.
In this Book
-
Systems Overview
-
Data Structures
-
The Volatility Framework
-
Memory Acquisition
-
Windows Objects and Pool Allocations
-
Processes, Handles, and Tokens
-
Process Memory Internals
-
Hunting Malware in Process Memory
-
Event Logs
-
Registry in Memory
-
Networking
-
Windows Services
-
Kernel Forensics and Rootkits
-
Windows GUI Subsystem, Part I
-
Windows GUI Subsystem, Part II
-
Risk Artifacts in Memory
-
Event Reconstruction
-
Timelining
-
Linux Memory Acquisition
-
Linux Operating System
-
Processes and Process Memory
-
Networking Artifacts
-
Kernel Memory Artifacts
-
File Systems in Memory
-
Userland Rootkits
-
Kernel Mode Rootkits
-
Case Study: Phalanx2
-
Mac Acquisition and Internals
-
Mac Memory Overview
-
Malicious Code and Rootkits
-
Tracking User Activity
