July 2006 Archives

Reassembling a binary from a memory dump can be a tedious task. Now Harlan Carvey has released a Perl script which automates the process.

I've got some questions regarding my IMF paper. So I decided to provide a use-case for an analysis based on pool allocations. This will reveal TCP/IP sockets in listening state and also network connections.

This article introduces a small, yet important data structure of the Microsoft Windows NT kernel, the POOL_HEADER. For sure I will rely on this structure on several occasions. Also my talk at the IMF 2006 conference will be dedicated to it.

My paper for the IMF 2006 conference in Stuttgart has been accepted. It is entitled Pool Allocations as an Information Source in Windows Memory Forensics.

In his master thesis Jorge M. Urrea-Civilian examines data structures of the Linux 2.6 series kernel. He describes how the virtual address space of a process can be reconstructed from a swap file and the physical memory. The thesis might become the foundation of tools to analyze a Linux memory dump.

Peter Kankowski has released an improved template for EXE- files to be used with Sweetscape's 010 Editor. This template also allows to parse 64bit binaries. For the first time the template recognizes the "Rich" header inserted into binaries by Microsoft's linkers.

In his presentation at the Techno Security 2006 conference Robert Botchek summarizes the basics of write blockers. The speaker is president of Tableau, LLC, a manufacturer of write blocking devices.