The Volatility team will give a talk at the next NYC4SEC meetup on memory forensics on May 8th, 2014 at John Jay College. Make sure to RSVP if you are planning to attend, since there is limited seating!
Thanks For the Memory: Rootkits, Exfil and APT - RAM Conquers All
The ability to perform digital investigations and incident response
is becoming a critical skill for many occupations. Unfortunately,
digital investigators frequently lack the training or experience to take
advantage of the volatile artifacts found in physical memory. Volatile
memory contains valuable information about the runtime state of the
system, provides the ability to link artifacts from traditional forensic
analysis (network, file system, registry), and provides the ability to
ascertain investigative leads that have been unbeknownst to most
analysts. Malicious adversaries have been leveraging this knowledge
disparity to undermine many aspects of the digital investigation process
with such things as anti-forensics techniques, memory resident malware,
kernel rootkits, encryption (file systems, network traffic, etc), and
Trojan defenses. The only way to turn-the-tables and defeat a creative
digital human adversary is through talented analysts.
This talk demonstrates the importance of including Volatile memory in
your investigations with an overview of the most widely used memory
forensics tool, Volatility, by its developers.
-@gleeda
