Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

More documents

Recommendations

Info

Conclusions • Applying registry analysis to memory can give you powerful new tools! • Some existing registry tools can be coaxed into working with memory • Still need tools to analyze volatile registry data (new RegRipper plugins?)
? Thanks! • To you all, for listening • To AAron Walters and the folks in #volatility • To Harlan Carvey, Tim Morgan, and many others for their work and insight on all matters registry-related ? ...any questions? ? ? ? ?
Page 1 and 2: Registry Analysis and Memory Forens
Page 3 and 4: Overview
Page 5 and 6: • Registry Analysis • Memory Fo
Page 7 and 8: • Registry Analysis • Memory Fo
Page 9 and 10: Windows Registry (cont.) • Regist
Page 11 and 12: Registry Forensics Tools • RegLoo
Page 13 and 14: Memory Forensics Tools • Memoryze
Page 15 and 16: Combining Registry and Memory Analy
Page 17 and 18: Solution: VolReg • Suite of plugi
Page 19 and 20: VolReg: Hivelist • Given one of t
Page 21 and 22: VolReg: Printkey • Given a hive a
Page 23 and 24: VolReg: Hashdump • Local account
Page 25 and 26: Others (not shown) • Cachedump: d
Page 27 and 28: Solution: VolRip • Python→Perl
Page 29 and 30: VolRip Example: Tracking USB Keys $
Page 31: Caveats • Since analysis is done

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Create successful ePaper yourself

Delete template?

Save as template?