int for(ensic){blog;}

Microsoft has just released version 8.1 of its Kernel Memory Space Analyzers to the public. This program provides a lot help when analyzing Windows memory dumps in DMP format.

By Andreas Schuster at 09/13/2006, 06:45 PM | Permalink

Arne Vidstrom explains how dumping a PC's main memory over FireWire could cause the Memory Controller Hub of an Intel chipset to hang.

By Andreas Schuster at 09/06/2006, 05:05 PM | Permalink

Version 0.3.00 of PTFinder has been released. This version adds some experimental support for XML output.

By Andreas Schuster at 09/03/2006, 06:00 PM | Permalink

I have posted a collection of PTfinders for Windows 2000, Windows XP (should be good for XP SP1 too), Windows XP SP2 and Windows Server 2003. I wish to thank reader "Frank" for his support. Please report bugs to bugs-ptfinder [at] forensikblog.de.

By Andreas Schuster at 08/10/2006, 07:00 PM | Permalink

As previously noted, a binary reconstructed from a memory dump may not match with the original file on disk. This raises the question how hash creation and file authentication procedures must be changed in order to provide this functionality.

By Andreas Schuster at 08/02/2006, 03:00 PM | Permalink

In a white paper AAron Walters describes how the Forensic Analysis ToolKits (FATKit) can be used to detect the injection of malicious code.

By Andreas Schuster at 08/01/2006, 03:00 PM | Permalink

Reassembling a binary from a memory dump can be a tedious task. Now Harlan Carvey has released a Perl script which automates the process.

By Andreas Schuster at 07/30/2006, 05:25 PM | Permalink

Reassembling a binary from a memory dump can be a tedious task. Now Harlan Carvey has released a Perl script which automates the process.

By Andreas Schuster at 07/30/2006, 05:25 PM | Permalink

I've got some questions regarding my IMF paper. So I decided to provide a use-case for an analysis based on pool allocations. This will reveal TCP/IP sockets in listening state and also network connections.

By Andreas Schuster at 07/27/2006, 03:05 PM | Permalink

This article introduces a small, yet important data structure of the Microsoft Windows NT kernel, the POOL_HEADER. For sure I will rely on this structure on several occasions. Also my talk at the IMF 2006 conference will be dedicated to it.

By Andreas Schuster at 07/25/2006, 05:15 PM | Permalink