The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory

Acknowledgments

We would like to thank the memory forensics community at large: those who spend their weekends, nights, and holidays conducting research and creating free, open-source code for practitioners. This includes developers and users, both past and present, that have contributed unique ideas, plugins, and bug fixes to the Volatility Framework. Specifically, for their help on this book, we want to recognize the following:

• Dr. Nick L. Petroni for his invaluable comments during the book review process and whose innovative research inspired the creation of Volatility.
• Dr. Golden G. Richard III for his expertise and commitment as technical editor.
• Mike Auty for his endless hours helping to maintain and shepherd the Volatility source code repository.
• Bruce Dang and Brian Carrier for taking time out of their busy schedules to review our book.
• Brendan Dolan-Gavitt for his numerous contributions to Volatility and the memory forensics field that were highlighted in the book.
• George M. Garner, Jr. (GMG Systems, Inc.) for his insight and guidance in the memory acquisition realm.
• Matthieu Suiche (MoonSols) for reviewing the Windows Memory Toolkit section and for his advancements in Mac OS X and Windows Hibernation analysis.
• Matt Shannon (Agile Risk Management) for this review of the F-Response section of the book.
• Jack Crook for reviewing our book and for providing realistic forensics challenges that involve memory samples and allowing people to use them to become better analysts. ...