Category "Library"

Harlan Carvey has posted a great summary article on Windows memory analysis. In fact it is a free sample chapter from his new book on Windows Forensic Analysis.

The Spring 2007 issue of the International Journal of Digital Evidence (IJDE) was just published.

One of the few books that really helped me to get into Windows memory analysis is "Undocumented Windows 2000 Secrets" by Sven B. Schreiber. Unfortunately the book is out of print for some time. A few used copies are sold at Amazon and other internet marketplaces - at prices so high that I'm considering to invest in books instead of shares.

Fortunately Sven is so kind to provide an electronic edition of his work as a set of PDF files free of charge at his web site. Thank you very much, Sven!

The upcoming issue of Digital Investigation (Vol. 3, Issue 4) will contain an interesting article by Nick L.Petroni, AAron Walters, Timothy Fraser and William A. Arbaugh about their memory analysis tool FATKit. A preprint is available free of charge at the FATKit website.

The paper Digital Image Ballistics from JPEG Quantization by Hany Farid describes how digital stills can be attributed to camera makes due to certain differences in the implementation of JPEG compression.

In his master thesis Jorge M. Urrea-Civilian examines data structures of the Linux 2.6 series kernel. He describes how the virtual address space of a process can be reconstructed from a swap file and the physical memory. The thesis might become the foundation of tools to analyze a Linux memory dump.

In his presentation at the Techno Security 2006 conference Robert Botchek summarizes the basics of write blockers. The speaker is president of Tableau, LLC, a manufacturer of write blocking devices.

There are a lot of books in print about digital forensics, but most of them are in English. Well, here's one in Portugese, entitled Perícia Forense Aplicada à Informática by Andrey Rodrigues de Freitas. I feel some of my dear readers might find this information useful.

I was quite surprised to actually see parts of the main memory survive a reboot for the first time. Well, Farmer and Venema were not the first to describe this. Here are two more interesting papers on that topic.