My slides from the ZISC Workshop 2010 on Digital Forensics and Security are now available. The speaker notes, unfortunately, are not. I hope my presentation on Recent Advances in Memory Forensics will be interesting anyway.
The presentation features the following papers (in no particular order):
- Takahiro Haruyama's port of Volatility to EnCase/EnScript, because it brings volatile data analysis techniques to a widely deployed analysis environment
- Matthieu Suiche's paper on Mac OS X Physical Memory Analysis, because it opens up access to volatile data on a new software platform
- Treasure and tragedy in kmem_cache mining for live forensics investigation by Andrew Case, Lodovico Marziale, Cris Neckar, and Golden G. Richard III, because their paper describes a new and efficient method to locate important kernel objects on Linux
- Robust signatures for kernel data structures by Brendan Dolan-Gavitt, Abhinav Srivastava, Patrick Traynor, and Jonathon Giffin, because their work significantly improves the robustness of scanner signatures
- Ruichao Zhang, Lianhai Wang, and Shuhui Zhang, because their paper "Windows Memory Analysis Based on KPCR" combines the concepts of scanning for a data structure and list traversal in order to locate data structures, that were hard to detect otherwise (with a mention of Damien Aumaitre and Bradley Schatz)