Digital Forensics and Incident Response - Second Edition

Memory analysis tools

There are several tools available to analysts for the review of memory images. Some tools provide a GUI for ease of use, while others operate via the command line, making them useful for scripting. For the purposes of this chapter, three tools will be examined. The first of these, Mandiant Redline, is a GUI-based memory analysis tool that examines memory images for signs of rogue processes and scores them based upon several factors. The second of these tools is Volatility, a command-line tool that allows analysts to drill into the details of the memory image and identify potentially malicious code. The final tool that will be examined is the Strings utility available in Linux. Strings allows keyword searching through ...