Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

More documents

Recommendations

Info

VolReg: Hivescan • Hivescan: finds raw offsets in memory image of registry hives • Not very useful by itself, but needed for other plugins • Once we have one hive offset, we can get a nicer list of all hives in memory $ volatility hivescan \ -f image.dd Offset (hex) 42168328 0x2837008 42195808 0x283db60 47598392 0x2d64b38 155764592 0x948c770 155973608 0x94bf7e8 208587616 0xc6ecb60 208964448 0xc748b60 234838880 0xdff5b60 243852936 0xe88e688 251418760 0xefc5888 252887048 0xf12c008 256039736 0xf42db38 269699936 0x10134b60 339523208 0x143cb688 346659680 0x14a99b60 377572192 0x16814b60
VolReg: Hivelist • Given one of the offsets from hivescan, finds all other hives in memory • Keep this list around! • The addresses in this list are what we will use for the other registry plugins
Page 1 and 2: Registry Analysis and Memory Forens
Page 3 and 4: Overview
Page 5 and 6: • Registry Analysis • Memory Fo
Page 7 and 8: • Registry Analysis • Memory Fo
Page 9 and 10: Windows Registry (cont.) • Regist
Page 11 and 12: Registry Forensics Tools • RegLoo
Page 13 and 14: Memory Forensics Tools • Memoryze
Page 15 and 16: Combining Registry and Memory Analy
Page 17: Solution: VolReg • Suite of plugi
Page 21 and 22: VolReg: Printkey • Given a hive a
Page 23 and 24: VolReg: Hashdump • Local account
Page 25 and 26: Others (not shown) • Cachedump: d
Page 27 and 28: Solution: VolRip • Python→Perl
Page 29 and 30: VolRip Example: Tracking USB Keys $
Page 31 and 32: Caveats • Since analysis is done
Page 33: ? Thanks! • To you all, for liste

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Create successful ePaper yourself

Delete template?

Save as template?