Home page logo

Security Incidents mailing list archives

Digital forensics of the physical memory
From: Mariusz Burdach <mariuszburdach () yahoo com>
Date: Wed, 15 Jun 2005 05:56:28 -0700 (PDT)


I have written a research paper on Digital forensics
of the physical memory. This is an introduction to new
area of forensics. 

The objective of this document is to demonstrate
methods that the physical memory image from the
compromised machine can be analyzed. At the moment,
only Linux memory image based on kernel 2.4.x is
presented. This “how-to” paper will try to show ways
of enumerating processes, recovering text and
executable files, detecting hidden processes,
identifying processes executed in the past,
correlating data from memory image and swap areas, and
so on. Document is available at: 

I also would like to announce a beta version of
idetect toolkit. This toolkit can be very helpful in
process of digital investigation of the physical

Idetect 0.1 can be obtained here:

Reader feedback and constructive criticism is
welcome and appreciated.

Mariusz Burdach


Yahoo! Mail Mobile 
Take Yahoo! Mail with you! Check email on your mobile phone. 

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]