Digital Forensics, Investigation, and Response 5E, 5th Edition

Malware Techniques

Generally, memory forensics is most often used in malware investigations. Therefore, it is advantageous to have an understanding of malware and malware techniques. In Chapter 2, we briefly introduced malware, but in this section, we will explore the topic in more depth. Malware can be divided into several categories. It should be noted that these categories are not strict. Many instances of malware fit into multiple, overlapping categories. However, these categories can be helpful for analysis.

Viruses

In computer science, the term viruses generally refers to any software that self-replicates. Some sources state that a virus attaches to a legitimate file, but that is not the definition we will use. There are many types of ...