| Introduction |
|
xvii | |
| I An Introduction to Memory Forensics |
|
1 | (114) |
|
|
|
3 | (24) |
|
|
|
3 | (1) |
|
|
|
4 | (13) |
|
|
|
17 | (1) |
|
|
|
18 | (2) |
|
|
|
20 | (4) |
|
|
|
24 | (1) |
|
|
|
25 | (1) |
|
|
|
26 | (1) |
|
|
|
27 | (18) |
|
|
|
27 | (16) |
|
|
|
43 | (2) |
|
3 The Volatility Framework |
|
|
45 | (24) |
|
|
|
45 | (1) |
|
|
|
46 | (1) |
|
|
|
47 | (4) |
|
|
|
51 | (8) |
|
|
|
59 | (8) |
|
|
|
67 | (2) |
|
|
|
69 | (46) |
|
Preserving the Digital Environment |
|
|
69 | (10) |
|
|
|
79 | (16) |
|
|
|
95 | (11) |
|
|
|
106 | (1) |
|
|
|
107 | (7) |
|
|
|
114 | (1) |
| II Windows Memory Forensics |
|
115 | (460) |
|
5 Windows Objects and Pool Allocations |
|
|
117 | (32) |
|
Windows Executive Objects |
|
|
117 | (12) |
|
|
|
129 | (11) |
|
Limitations of Pool Scanning |
|
|
140 | (2) |
|
|
|
142 | (4) |
|
Pool-Scanning Alternatives |
|
|
146 | (2) |
|
|
|
148 | (1) |
|
6 Processes, Handles, and Tokens |
|
|
149 | (40) |
|
|
|
149 | (15) |
|
|
|
164 | (6) |
|
|
|
170 | (6) |
|
|
|
176 | (5) |
|
Enumerating Handles in Memory |
|
|
181 | (6) |
|
|
|
187 | (2) |
|
7 Process Memory Internals |
|
|
189 | (30) |
|
What's in Process Memory? |
|
|
189 | (4) |
|
Enumerating Process Memory |
|
|
193 | (24) |
|
|
|
217 | (2) |
|
8 Hunting Malware in Process Memory |
|
|
219 | (46) |
|
Process Environment Block |
|
|
219 | (19) |
|
|
|
238 | (7) |
|
|
|
245 | (6) |
|
|
|
251 | (12) |
|
|
|
263 | (2) |
|
|
|
265 | (16) |
|
|
|
265 | (10) |
|
|
|
275 | (4) |
|
|
|
279 | (2) |
|
|
|
281 | (28) |
|
Windows Registry Analysis |
|
|
281 | (11) |
|
Volatility's Registry API |
|
|
292 | (3) |
|
|
|
295 | (2) |
|
Detecting Malware with the Shimcache |
|
|
297 | (1) |
|
Reconstructing Activities with Shellbags |
|
|
298 | (6) |
|
|
|
304 | (1) |
|
|
|
305 | (2) |
|
|
|
307 | (2) |
|
|
|
309 | (34) |
|
|
|
309 | (14) |
|
|
|
323 | (2) |
|
|
|
325 | (2) |
|
Next Generation TCP/IP Stack |
|
|
327 | (6) |
|
|
|
333 | (6) |
|
|
|
339 | (2) |
|
|
|
341 | (2) |
|
|
|
343 | (24) |
|
|
|
343 | (2) |
|
|
|
345 | (1) |
|
|
|
346 | (1) |
|
Investigating Service Activity |
|
|
347 | (19) |
|
|
|
366 | (1) |
|
13 Kernel Forensics and Rootkits |
|
|
367 | (40) |
|
|
|
367 | (5) |
|
|
|
372 | (6) |
|
|
|
378 | (3) |
|
|
|
381 | (5) |
|
|
|
386 | (4) |
|
|
|
390 | (6) |
|
|
|
396 | (3) |
|
|
|
399 | (3) |
|
|
|
402 | (4) |
|
|
|
406 | (1) |
|
14 Windows GUI Subsystem, Part I |
|
|
407 | (46) |
|
|
|
407 | (3) |
|
|
|
410 | (1) |
|
|
|
410 | (6) |
|
|
|
416 | (6) |
|
|
|
422 | (7) |
|
|
|
429 | (6) |
|
|
|
435 | (17) |
|
|
|
452 | (1) |
|
15 Windows GUI Subsystem, Part II |
|
|
453 | (24) |
|
|
|
453 | (6) |
|
|
|
459 | (7) |
|
|
|
466 | (2) |
|
|
|
468 | (4) |
|
Case Study: ACCDFISA Ransomware |
|
|
472 | (4) |
|
|
|
476 | (1) |
|
16 Disk Artifacts in Memory |
|
|
477 | (34) |
|
|
|
477 | (16) |
|
|
|
493 | (10) |
|
Defeating TrueCrypt Disk Encryption |
|
|
503 | (7) |
|
|
|
510 | (1) |
|
|
|
511 | (26) |
|
|
|
511 | (12) |
|
|
|
523 | (13) |
|
|
|
536 | (1) |
|
|
|
537 | (38) |
|
|
|
537 | (2) |
|
|
|
539 | (4) |
|
|
|
543 | (30) |
|
|
|
573 | (2) |
| III Linux Memory Forensics |
|
575 | (198) |
|
19 Linux Memory Acquisition |
|
|
577 | (14) |
|
Historical Methods of Acquisition |
|
|
577 | (2) |
|
|
|
579 | (4) |
|
Volatility Linux Profiles |
|
|
583 | (6) |
|
|
|
589 | (2) |
|
20 Linux Operating System |
|
|
591 | (46) |
|
|
|
591 | (12) |
|
|
|
603 | (4) |
|
Linux Address Translation |
|
|
607 | (2) |
|
|
|
609 | (1) |
|
|
|
610 | (1) |
|
|
|
610 | (1) |
|
Processes and Process Memory |
|
|
611 | (1) |
|
|
|
611 | (2) |
|
|
|
613 | (3) |
|
|
|
616 | (9) |
|
Process Environment Variables |
|
|
625 | (1) |
|
|
|
626 | (4) |
|
|
|
630 | (1) |
|
|
|
630 | (5) |
|
|
|
635 | (2) |
|
|
|
637 | (20) |
|
Network Socket File Descriptors |
|
|
637 | (3) |
|
|
|
640 | (3) |
|
|
|
643 | (3) |
|
|
|
646 | (4) |
|
|
|
650 | (2) |
|
|
|
652 | (3) |
|
|
|
655 | (2) |
|
23 Kernel Memory Artifacts |
|
|
657 | (18) |
|
|
|
657 | (4) |
|
|
|
661 | (2) |
|
|
|
663 | (4) |
|
|
|
667 | (6) |
|
|
|
673 | (2) |
|
24 File Systems in Memory |
|
|
675 | (22) |
|
|
|
675 | (6) |
|
Listing Files and Directories |
|
|
681 | (3) |
|
|
|
684 | (7) |
|
|
|
691 | (4) |
|
|
|
695 | (2) |
|
|
|
697 | (24) |
|
|
|
698 | (5) |
|
|
|
703 | (2) |
|
|
|
705 | (7) |
|
|
|
712 | (4) |
|
|
|
716 | (2) |
|
|
|
718 | (1) |
|
|
|
719 | (2) |
|
|
|
721 | (34) |
|
|
|
721 | (1) |
|
|
|
722 | (6) |
|
|
|
728 | (2) |
|
|
|
730 | (4) |
|
System Call Handler Hooks |
|
|
734 | (1) |
|
|
|
735 | (4) |
|
|
|
739 | (3) |
|
Network Protocol Structures |
|
|
742 | (3) |
|
|
|
745 | (3) |
|
|
|
748 | (4) |
|
|
|
752 | (2) |
|
|
|
754 | (1) |
|
|
|
755 | (18) |
|
|
|
755 | (2) |
|
|
|
757 | (6) |
|
Reverse Engineering Phalanx2 |
|
|
763 | (9) |
|
Final Thoughts on Phalanx2 |
|
|
772 | (1) |
|
|
|
772 | (1) |
| IV Mac Memory Forensics |
|
773 | (86) |
|
28 Mac Acquisition and Internals |
|
|
775 | (18) |
|
|
|
775 | (5) |
|
|
|
780 | (4) |
|
|
|
784 | (3) |
|
|
|
787 | (4) |
|
|
|
791 | (2) |
|
|
|
793 | (30) |
|
Mac versus Linux Analysis |
|
|
793 | (1) |
|
|
|
794 | (5) |
|
|
|
799 | (5) |
|
|
|
804 | (4) |
|
|
|
808 | (3) |
|
Recovering File Systems from Memory |
|
|
811 | (4) |
|
|
|
815 | (3) |
|
|
|
818 | (1) |
|
|
|
819 | (2) |
|
|
|
821 | (2) |
|
30 Malicious Code and Rootkits |
|
|
823 | (22) |
|
Userland Rootkit Analysis |
|
|
823 | (5) |
|
|
|
828 | (10) |
|
Common Mac Malware in Memory |
|
|
838 | (6) |
|
|
|
844 | (1) |
|
31 Tracking User Activity |
|
|
845 | (14) |
|
|
|
845 | (4) |
|
|
|
849 | (9) |
|
|
|
858 | (1) |
| Index |
|
859 | |