Volatility News

Things have been busy lately, but I want to let you know about some important items that are coming up quickly:

July 27-30th, 2013: Blackhat Vegas

Andrew Case and I will teach our course in Digital Forensics and Incident Response again this summer at Black Hat Vegas.  This course will cover enough material to take someone from knowing practically nothing about digital forensics (disk and memory) to a point where s/he can comfortably conduct his/her own investigations.  There is limited time to sign up, so reserve your seat while you can!

You can hear Andrew talk about Digital Forensics and Incident Response on the Healthy Paranoia podcast from July 7th, 2013.

August 1st, 2013: Volatility Plugin Contest

The 1st Annual Volatility Plugin Contest deadline is quickly approaching!   Don't miss this opportunity to win over $2000 in cash and prizes and contribute to the top memory forensics framework by writing a plugin for the Volatility Framework and submitting it to volcon2013@memoryanalysis.net by August 1st, 2013.

September 9-13th, 2013: Volatility Training in the Netherlands

We will have our 4th public offering of our official Windows Malware and Memory Forensics training in the Netherlands September 9-13, 2013.  This will be our only offering outside the US for this year.  Past offerings of our course have been well received and were recently described as the "... perfect combination of incident response, malware analysis and Windows internals."  Don't miss out on your chance to take this course and learn not only how to become a Volatility superuser, but how to apply cutting edge memory and malware analysis methodologies against your worst adversary.

November 4th, 2013: Open Memory Forensics Workshop (OMFW)

The Open Memory Forensics Workshop (OMFW) call for papers has been announced.  If you want to give a talk on memory forensics related topics, please get your submission in by September 1st, 2013.  OMFW is a half-day workshop that will be held one day prior to the Open Source Digital Forensics Conference in Chantilly, VA.  This workshop is fast-paced, to the point, highly technical and intended to raise the bar for analysts who realize the importance of memory forensics when faced with a highly skilled adversary.  Not only will you learn a lot and get to meet all the movers and shakers in the space, but your $50 registration fee is entirely donated to charity!  Last year all proceeds went to the National Center for Missing and Exploited Children.  So don't delay: there really is limited seating and it does go quickly.  Make sure to register your seat now!

November 5th, 2013: Open Source Digital Forensics Conference

The Volatility team will be at the Open Source Digital Forensics Conference discussing The State of Volatility.  Come by and see us there :-)

November 11-15th, 2013: Volatility Training in Reston, VA

We will have our 5th public offering of the official Windows Malware and Memory Forensics training in Reston, VA November 11-15th, 2013.  If you missed the last offering in June, this is your chance to take this course and learn from the developers themselves.  As I've stated before, this class includes real-world scenarios that are reinforced with hands-on labs.  We cover more than "just one tool" as some detractors like to say.  We cover methodologies that will actually help you where some tools fail.  You will have a deep enough understanding to investigate even the most skilled adversaries who know how to break common tools in order to hide.  Don't be fooled and don't be left behind.  Accept no imitations and make sure to take this class.

All students who take the official Volatility training receive a certificate of completion, with CPE credits that can be used for certification renewal.  In addition to this, we are constantly updating the course with new material and past students are given updated materials for FREE.  What more can you ask for?  If you are interested in Volatility training, drop us a line at voltraining [[ at ]] memoryanalysis.net

If you want to see co-trainers MHL and Andrew Case (attrc) in action, I managed to find a couple of videos of their previous talks on youtube:

Upcoming Events and Trainings

I have several speaking and training events that are coming up this year that may be of interest to others in the community:

I will be speaking at the New York Banker's Association's upcoming Annual Technology, Compliance & Risk Management Forum on May 16th, 2013 on the topic of Incident Response and Digital Forensics.  If you plan to attend I'll see you there!

Also we (Volatility) are holding our third run of Windows Malware and Memory Forensics in Reston, VA from Monday June 10th through Friday, June 14th 2013.  This training will not disappoint even the most proficient of forensic/malware analysts.  It includes real-world scenarios that are reinforced with hands-on labs.  All students will leave with skills and confidence to conduct investigations involving RAM samples from acquisition to the final report.  Students also leave with more than just being Volatility power users, they leave with a deeper knowledge of memory forensics and malware analysis methodologies.  Such knowledge is integral regardless of what tools you choose for future investigations, be they open source or commercial, and much more powerful than simply "run this tool, the output is colored red so it's bad".  You'll leave the class with knowledge that will help you to figure out if something really is "bad" or not.  There are still a few seats left for this training, so if you are interested you should register soon.  Send an email to voltraining [at] memoryanalysis.net for registration information.

If you are looking for a course that covers both disk and memory forensics, Andrew Case and I will teach our course in Digital Forensics and Incident Response again this summer at Black Hat Vegas.  This course runs from July 27th through July 30th 2013 and will cover enough material to take someone from knowing practically nothing about digital forensics to a point where s/he can comfortably conduct his/her own investigations.

Also we (Volatility) will hold another run of Windows Malware and Memory Forensics in the Netherlands from Monday September 9th through Friday, September 13th 2013.  Details will appear soon on the Volatility Labs blog.

Planning for the Open Memory Forensics Workshop (OMFW) is in progress.  You should plan to attend if you want to know what's new and hot in the memory forensics space.  OMFW is likely to take place on November 4th, 2013 one day prior to the Sleuth Kit and Open Source Digital Forensics Conference.  Final details will appear soon on the Volatility Labs blog.

Windows Malware and Memory Forensics Training in The Windy City!

Cross posted from the Volatility Labs Blog: 

The next journey to the center of Windows Memory Forensics starts in Chicago this March!  

We are pleased to announce the second public offering of the Windows Malware and Memory Forensics Training by The Volatility Project. This is the only memory forensics course officially designed, sponsored, and taught by the Volatility developers. One of the main reasons we made Volatility open-source is to encourage and facilitate a deeper understanding of how memory analysis works, where the evidence originates, and how to interpret the data collected by the framework's extensive set of plugins. Now you can learn about these benefits first hand from the developers of the most powerful, flexible, and innovative memory forensics tool. 
Appraisal from your peers who attended the first course this past December:

Please see the following details about the upcoming training event:
Dates: Monday, March 18th through Friday, March 22nd 2013
Location: Downtown Chicago, IL (exact location will be shared upon registration)
Instructors: Michael Ligh (@iMHLv2), Andrew Case (@attrc), Jamie Levy (@gleeda)
For more information about the course, view the Volatility Training Flyer (to download a copy of the PDF, click File > Download). To request a link to the online registration site or to receive a detailed course agenda/outline, please send an email voltraining [at] memoryanalysis.net.

The 1st Annual Volatility Framework Plugin Contest

Cross posted from the Volatility Labs Blog:

We are pleased to announce the 1st Annual Volatility Plugin Contest. This contest is inspired and modeled after the Hex-Rays Plugin Contest.  As in the case of IDA, Volatility was designed with the belief that talented analysts should only be limited by their creativity not the tools they use. In this spirit, Volatility has a flexible architecture that can be extended in numerous ways: analysis plugins (operating system plugins, application plugins, etc), volshell commands, address spaces, profiles, or user interfaces. This contest is intended to inspire people to demonstrate their creativity, become a memory analysis pioneer, win the admiration of your peers, and give back to the community.

The contest is straightforward: Create an innovative and useful extension to The Volatility Framework and win the contest!

• 1st place wins one free seat at any future Windows Malware and Memory Forensics Training *or* 1500 USD cash
• 2nd place wins 500 USD cash
• 3rd place wins 250 USD cash
• 4th and 5th place wins Volatility swag (T-shirts, Stickers, etc)

Everyone but the Volatility core developers can participate.

Rules of Engagement

1. The goal of the contest is to create innovative, interesting, and useful extensions for The Volatility Framework. While extensions written in Python are preferred, extensions written in other languages will also be considered.
2. The submitted extensions should work with the Volatility 2.2 (or greater) release and should have been implemented after the initial contest announcement (1/14/2013).
3. The top 5 winners of the contest will get the prizes mentioned above.
4. Volatility core developers are not eligible.
5. Submissions should be sent to volcon2013@memoryanalysis.net. The submission should include the source code, a short description of how the extension is used, and a signed "Individual Contributor License Agreement".
6. By submitting an entry, you declare that you own the copyright to the source code and are authorized to submit it.
7. All submissions should be received no later than August 1, 2013. The winner will be announced the following week. We recommend submitting early. In the case of similar submissions, preference will be shown to early submissions.
8. The Volatility Project core developers will decide the winners based on the following criteria: creativity, usefulness, effort, completeness, submission date, and clarity of documentation.
9. In order to collect the cash prizes, the winner will need to provide a legal picture identification and bank account information within 30 days of notification. The bank transfer will be made within two weeks after the winner is authenticated.
10. Group entries are allowed; the prize will be paid (or seat will be registered, if the training option is desired) to the person designated by the group.
11. Upon approval from the winners, their names/aliases will be listed on the "Volatility Hall of Fame" web page for the world to admire.
12. Selected contestants may also be asked to present their work at the 2013 Open Memory Forensics Workshop or have their research featured on the Volatility Labs Blog.

Acknowledgements

A special thanks goes out to the Hex-Rays team for providing the inspiration and template for this contest.