book

Practical Memory Forensics

Name: Practical Memory Forensics
ISBN: 9781801070331

by Svetlana Ostrovskaya, Oleg Skulkin

March 2022

Intermediate to advanced

304 pages

5h 58m

English

Packt Publishing

Read now

Unlock full access

Contributors
About the authorsAbout the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesConventions usedGet in touchShare your thoughts
Section 1: Basics of Memory Forensics
Chapter 1: Why Memory Forensics?
Understanding the main benefits of memory forensicsNo trace is left behindPrivacy keeperLearning about the investigation goals and methodologyThe victim's deviceThe suspect's deviceDiscovering the challenges of memory forensicsToolsCritical systemsInstabilitySummary
Chapter 2: Acquisition Process
Introducing memory management concepts Address spaceVirtual memoryPagingShared memoryStack and heapWhat's live memory analysis?WindowsLinux and macOSUnderstanding partial versus full memory acquisitionExploring popular acquisition tools and techniquesVirtual or physicalLocal or remoteHow to chooseIt's timeSummary
Section 2: Windows Forensic Analysis
Chapter 3: Windows Memory Acquisition
Understanding Windows memory-acquisition issuesPreparing for Windows memory acquisitionAcquiring memory with FTK imagerAcquiring memory with WinPmemAcquiring memory with Belkasoft RAM CapturerAcquiring memory with Magnet RAM CaptureSummary
Chapter 4: Reconstructing User Activity with Windows Memory Forensics
Technical requirementsAnalyzing launched applicationsIntroducing VolatilityProfile identificationSearching for active processesSearching for finished processesSearching for opened documentsDocuments in process memoryInvestigating browser historyChrome analysis with yarascanFirefox analysis with bulk extractorTor analysis with StringsExamining communication applicationsEmail, email, email Instant messengers Recovering user passwordsHashdumpCachedumpLsadumpPlaintext passwords Detecting crypto containersInvestigating Windows RegistryVirtual registry Installing MemProcFSWorking with Windows RegistrySummary
Chapter 5: Malware Detection and Analysis with Windows Memory Forensics
Searching for malicious processesProcess namesDetecting abnormal behaviorAnalyzing command-line argumentsCommand line arguments of the processesCommand history Examining network connectionsProcess – initiatorIP addresses and portsDetecting injections in process memoryDynamic-link library injectionsPortable executable injectionsProcess HollowingProcess Doppelgänging Looking for evidence of persistenceBoot or Logon Autostart ExecutionCreate AccountCreate or Modify System ProcessScheduled taskCreating timelinesFilesystem-based timelinesMemory-based timelinesSummary
Chapter 6: Alternative Sources of Volatile Memory
Investigating hibernation filesAcquiring a hibernation fileAnalyzing hiberfil.sysExamining pagefiles and swapfilesAcquiring pagefiles Analyzing pagefile.sysAnalyzing crash dumpsCrash dump creationAnalyzing crash dumpsSummary

Section 3: Linux Forensic Analysis
Chapter 7: Linux Memory Acquisition
Understanding Linux memory acquisition issuesPreparing for Linux memory acquisition Acquiring memory with LiMEAcquiring memory with AVMLCreating a Volatility profileSummary
Chapter 8: User Activity Reconstruction
Technical requirementsInvestigating launched programsAnalyzing Bash historySearching for opened documentsRecovering the filesystem Checking browsing historyInvestigating communication applicationsLooking for mounted devicesDetecting crypto containersSummary
Chapter 9: Malicious Activity Detection
Investigating network activityAnalyzing malicious activityExamining kernel objectsSummary
Section 4: macOS Forensic Analysis
Chapter 10: MacOS Memory Acquisition
Understanding macOS memory acquisition issuesPreparing for macOS memory acquisition Acquiring memory with osxpmemCreating a Volatility profileSummary
Chapter 11: Malware Detection and Analysis with macOS Memory Forensics
Learning the peculiarities of macOS analysis with VolatilityTechnical requirementsInvestigating network connectionsAnalyzing processes and process memoryRecovering the filesystem Obtaining user application dataSearching for malicious activitySummary
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare your thoughts

Content preview from Practical Memory Forensics

Section 2: Windows Forensic Analysis

This section will take you through the Windows memory acquisition process and memory dump analysis, including recovering user actions and hunting malicious activity in memory.

This section of the book comprises the following chapters:

Chapter 3, Windows Memory Acquisition
Chapter 4, Reconstructing User Activity with Windows Memory Forensics
Chapter 5, Malware Detection and Analysis with Windows Memory Forensics
Chapter 6, Alternative Sources of Volatile Memory

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781801070331

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Practical Memory Forensics

by Svetlana Ostrovskaya, Oleg Skulkin

Section 2: Windows Forensic Analysis

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.