May 2012
Intermediate to advanced
560 pages
12h 55m
English
book
Malware Forensics Field Guide for Windows Systems
by Cameron H. Malin, Eoghan Casey, James M. Aquilina
Content preview from Malware Forensics Field Guide for Windows Systems
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Chapter 2
Memory Forensics
Analyzing Physical and Process Memory Dumps for Malware Artifacts
Solutions in this chapter:
• Memory Forensics Overview
• Old School Memory Analysis
• How Windows Memory Forensic Tools Work
• Windows Memory Forensic Tools
• Dumping Windows Process Memory
• Dissecting Windows Process Memory
Introduction
The importance of memory forensics in malware investigations cannot be overstated. A complete capture of memory on a compromised computer generally bypasses the methods that malware uses to trick operating systems, providing digital investigators with a more comprehensive view of the malware. In some cases, malware leaves little trace elsewhere on the compromised system and the only clear indications of compromise ...