DEF CON 19 - Jamie Butler - Physical Memory Forensics for Cache
257 views · Published 2 November 2013 · 49:43 · Indexed 31 October 2026
Channel: DEFCONConference · 2013 · Science & Technology
Jamie Butler - Physical Memory Forensics for Cache Physical memory forensics has gained a lot of traction over the past five or six years. While it will never eliminate the need for disk forensics, memory analysis has proven its efficacy during incident response and more traditional forensic investigations. Previously, memory forensics, although useful, focused on a process' address space in the form of Virtual Address Descriptors (VADs) but ignored other rich sources of information. In the past, some techniques of process reconstitution have been auspicious at best and erroneous at worst. This presentation will build upon lessons learned and propose more thorough ways to reconstruct process contents, and therefore a process' address space. By using the methods presented, it will be possible to further reduce the data you care about in an incident response or forensic investigation and to better apply the traditional computer security techniques such as reverse engineering, hash matching, and byte pattern or signature matching such as those provided by ClamAV and VxClass.
More from this channel
-
1:25
DEF CON 20 Documentary Bonus Clips - We Make No Money From You
-
1:15
DEF CON 20 Documentary Bonus Clips - Alexis Park Home Improvement
-
7:53
DEF CON 20 Documentary Bonus Clips - CDC muxed
-
3:45
DEF CON 20 Documentary Bonus Clips - Not the Same Anymore
-
2:27
DEF CON 20 Documentary Bonus Clips - Being a Party Host
-
2:09
DEF CON 20 Documentary Bonus Clips - A Top Qualitty Production
-
1:36
DEF CON 20 Documentary Bonus Clips - Creme Brulee
-
2:39
DEF CON 20 Documentary Bonus Clips - Barkode and Bloodkode