July 2018
Beginner to intermediate
232 pages
7h 59m
English
Virtualisation, smart malware, ephemeral containers, full-disk encryption – just some of the reasons that being able to navigate acquired memory images has become such an important skill for digital forensic investigators and incident responders alike. An incident can occur completely within the confines of volatile memory. Like the mythical bullet made of ice, the suspect intends volatile evidence to simply melt away without a trace once a victim has been claimed.
Unlike analysis of persistent file systems on hard disks and other archival media, the nature of volatile memory means that its contents are less structured. If looking for digital evidence on a hard disk is like looking for a needle in a haystack with the help ...