Security Incidents: Digital forensics of the physical memory

[Mariusz Burdach <mariuszburdach () yahoo com>]

Hello,

I have written a research paper on Digital forensics
of the physical memory. This is an introduction to new
area of forensics. 

The objective of this document is to demonstrate
methods that the physical memory image from the
compromised machine can be analyzed. At the moment,
only Linux memory image based on kernel 2.4.x is
presented. This “how-to” paper will try to show ways
of enumerating processes, recovering text and
executable files, detecting hidden processes,
identifying processes executed in the past,
correlating data from memory image and swap areas, and
so on. Document is available at: 
http://forensic.seccure.net/pdf/mburdach_digital_forensics_of_physical_memory.pdf

I also would like to announce a beta version of
idetect toolkit. This toolkit can be very helpful in
process of digital investigation of the physical
memory.

Idetect 0.1 can be obtained here:
http://forensic.seccure.net/tools/idetect.tar.gz 

Reader feedback and constructive criticism is
welcome and appreciated.

Regards,
Mariusz Burdach

Mariusz.Burdach[at]seccure[dot]net
http://forensic.seccure.net 



                
__________________________________ 
Yahoo! Mail Mobile 
Take Yahoo! Mail with you! Check email on your mobile phone. 
http://mobile.yahoo.com/learn/mail