Physical Memory Forensics for Cache

Architecture and Background

Jamie Butler - Physical Memory Forensics for Cache Physical memory forensics has gained a lot of traction over the past five or six years.

Vulnerability Analysis

While it will never eliminate the need for disk forensics, memory analysis has proven its efficacy during incident response and more traditional forensic investigations.

Exploitation and Demonstrations

Previously, memory forensics, although useful, focused on a process' address space in the form of Virtual Address Descriptors (VADs) but ignored other rich sources of information.

Remediation and Defensive Strategies

In the past, some techniques of process reconstitution have been auspicious at best and erroneous at worst. This presentation will build upon lessons learned and propose more thorough ways to reconstruct process contents, and therefore a process' address space. By using the methods presented, it will be possible to further reduce the data you care about in an incident response or forensic investigation and to better apply the traditional computer security techniques such as reverse engineering, hash matching, and byte pattern or signature matching such as those provided by ClamAV and VxClass.