The Art of Memory Forensics

Michael Hale Ligh 지음

Wiley 2014년 07월 22일 출간

작품소개

책소개

Memory forensics provides cutting edge technology to help investigate digital attacksMemory forensics is the art of analyzing computer memory (RAM) to solve digital crimes. As a follow-up to the best seller Malware Analyst's Cookbook, experts in the fields of malware, security, and digital forensics bring you a step-by-step guide to memory forensicsm-now the most sought after skill in the digital forensics and incident response fields.Beginning with introductory concepts and moving toward the advanced, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory is based on a five day training course that the authors have presented to hundreds of students. It is the only book on the market that focuses exclusively on memory forensics and how to deploy such techniques properly. Discover memory forensics techniques:How volatile memory analysis improves digital investigationsProper investigative steps for detecting stealth malware and advanced threatsHow to use free, open source tools for conducting thorough memory forensicsWays to acquire memory from suspect systems in a forensically sound mannerThe next era of malware and security breaches are more sophisticated and targeted, and the volatile memory of a computer is often overlooked or destroyed as part of the incident response process. The Art of Memory Forensics explains the latest technological innovations in digital forensics to help bridge this gap. It covers the most popular and recently released versions of Windows, Linux, and Mac, including both the 32 and 64-bit editions.

목차

Introduction xviiI An Introduction to Memory Forensics 11 Systems Overview 3Digital Environment 3PC Architecture 4Operating Systems& 17Process Management 18Memory Management&& 20File System 24I/O Subsystem 25Summary 262 Data Structures& 27Basic Data Types&& 27Summary 433 The Volatility Framework& 45Why Volatility? 45What Volatility Is Not&& 46Installation 47The Framework 51Using Volatility 59Summary 674 Memory Acquisition 69Preserving the Digital Environment 69Software Tools 79Memory Dump Formats 95Converting Memory Dumps 106Volatile Memory on Disk 107Summary 114II Windows Memory Forensics 1155 Windows Objects and Pool Allocations 117Windows Executive Objects& 117Pool-Tag Scanning 129Limitations of Pool Scanning 140Big Page Pool 142Pool-Scanning Alternatives& 146Summary 1486 Processes, Handles, and Tokens 149Processes& 149Process Tokens 164Privileges 170Process Handles 176Enumerating Handles in Memory 181Summary 1877 Process Memory Internals& 189What&'s in Process Memory? 189Enumerating Process Memory 193Summary 2178 Hunting Malware in Process Memory 219Process Environment Block& 219PE Files in Memory 238Packing and Compression&& 245Code Injection 251Summary 2639 Event Logs 265Event Logs in Memory& 265Real Case Examples 275Summary 27910 Registry in Memory& 281Windows Registry Analysis& 281Volatility&'s Registry API 292Parsing Userassist Keys 295Detecting Malware wit

작가정보

저자(글) Michael Hale Ligh

저자 :

저자 :

저자 :

저자 :

저자 :
Michael Hale-Ligh is author of Malware Analyst's Cookbook, Secretary/Treasurer of Volatility Foundation, and a world-class reverse engineer.Andrew Case is a Digital Forensics Researcher specializing in memory, disk, and network forensics.Jamie Levy is a Senior Researcher and Developer, targeting memory, network, and malware forensics analysis.AAron Walters is founder and lead developer of the Volatility Project, President of the Volatility Foundation, and Chair of Open Memory Forensics Workshop.