int for(ensic){blog;}

Reassembling a binary from a memory dump can be a tedious task. Now Harlan Carvey has released a Perl script which automates the process.

By Andreas Schuster at 07/30/2006, 05:25 PM | Permalink

Version 2.05 of the Sleuth Kit has been released. It now supports NTFS compression for files and folders.

By Andreas Schuster at 07/28/2006, 03:20 PM | Permalink

I've got some questions regarding my IMF paper. So I decided to provide a use-case for an analysis based on pool allocations. This will reveal TCP/IP sockets in listening state and also network connections.

By Andreas Schuster at 07/27/2006, 03:05 PM | Permalink

This article introduces a small, yet important data structure of the Microsoft Windows NT kernel, the POOL_HEADER. For sure I will rely on this structure on several occasions. Also my talk at the IMF 2006 conference will be dedicated to it.

By Andreas Schuster at 07/25/2006, 05:15 PM | Permalink

My paper for the IMF 2006 conference in Stuttgart has been accepted. It is entitled Pool Allocations as an Information Source in Windows Memory Forensics.

By Andreas Schuster at 07/10/2006, 08:40 PM | Permalink

In his master thesis Jorge M. Urrea-Civilian examines data structures of the Linux 2.6 series kernel. He describes how the virtual address space of a process can be reconstructed from a swap file and the physical memory. The thesis might become the foundation of tools to analyze a Linux memory dump.

By Andreas Schuster at 07/10/2006, 04:00 PM | Permalink

Peter Kankowski has released an improved template for EXE- files to be used with Sweetscape's 010 Editor. This template also allows to parse 64bit binaries. For the first time the template recognizes the "Rich" header inserted into binaries by Microsoft's linkers.

By Andreas Schuster at 07/08/2006, 03:25 PM | Permalink

In his presentation at the Techno Security 2006 conference Robert Botchek summarizes the basics of write blockers. The speaker is president of Tableau, LLC, a manufacturer of write blocking devices.

By Andreas Schuster at 07/06/2006, 08:45 PM | Permalink