Practical Memory Forensics: Jumpstart effective forensic analysis of volatile memory
About this ebook
- Explore memory forensics, one of the vital branches of digital investigation
- Learn the art of user activities reconstruction and malware detection using volatile memory
- Get acquainted with a range of open-source tools and techniques for memory forensics
- Understand the fundamental concepts of memory organization
- Discover how to perform a forensic investigation of random access memory
- Create full memory dumps as well as dumps of individual processes in Windows, Linux, and macOS
- Analyze hibernation files, swap files, and crash dumps
- Apply various methods to analyze user activities
- Use multiple approaches to search for traces of malicious activity
- Reconstruct threat actor tactics and techniques using random access memory analysis
This book is for incident responders, digital forensic specialists, cybersecurity analysts, system administrators, malware analysts, students, and curious security professionals new to this field and interested in learning memory forensics. A basic understanding of malware and its working is expected. Although not mandatory, knowledge of operating systems internals will be helpful. For those new to this field, the book covers all the necessary concepts.
Discover more
About the author
Svetlana Ostrovskaya is a practicing specialist in digital forensics and incident response at Group-IB. She is the author of DFIR training programs and cybersecurity crisis management workshops, and the author and co-author of blog posts, articles, and books on information security, computer forensics, and incident response.
Oleg Skulkin is the Head of Digital Forensics and Malware Analysis Laboratory at Group-IB. Oleg has worked in the fields of digital forensics, incident response, and cyber threat intelligence and research for over a decade, fueling his passion for uncovering new techniques used by hidden adversaries. Oleg has authored and co-authored multiple blog posts, papers, and books on related topics and holds GCFA and GCTI certifications.
