Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

13.07.2013 • Views

Share Embed Flag

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

Brendan Dolan-Gavitt Georgia Institute of Technology - SANS

DOWNLOAD ePAPER

computer.forensics.sans.org

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

START NOW

• Registry Analysis<br />

• Memory Forensics<br />

Overview<br />

+

Building, Maturing & Rocking a Security Operations Center - SANS ...

Sniper Forensics “One Shot, One Kill” - SANS Computer Forensics

exFAT History - SANS Computer Forensics

examples of recent apt persistence mechanisms - SANS Computer ...

Ovie Carroll - SANS Forensic Trends and Futures.pdf

Analysis & Correlation of Mac Logs - SANS

“ANN'S AURORA” - SANS Computer Forensics

Encryption v20.10 - SANS Computer Forensics

Tales from the Crypt - TrueCrypt Analysis - SANS

Digital Forensics for IaaS Cloud Computing - SANS Computer ...

All the Gear..and No Idea.. - Scalable, fast - SANS

Protecting Privileged Domain Accounts during Live Response

Mark McKinnon RedWolf Computer Forensics Mark ... - SANS

Taking Registry Analysis to the Next Level - SANS Computer ...

• Registry Analysis Overview

• Registry Analysis • Memory Forensics Overview +

Page 1 and 2: Registry Analysis and Memory Forens
Page 3: Overview
Page 7 and 8: • Registry Analysis • Memory Fo
Page 9 and 10: Windows Registry (cont.) • Regist
Page 11 and 12: Registry Forensics Tools • RegLoo
Page 13 and 14: Memory Forensics Tools • Memoryze
Page 15 and 16: Combining Registry and Memory Analy
Page 17 and 18: Solution: VolReg • Suite of plugi
Page 19 and 20: VolReg: Hivelist • Given one of t
Page 21 and 22: VolReg: Printkey • Given a hive a
Page 23 and 24: VolReg: Hashdump • Local account
Page 25 and 26: Others (not shown) • Cachedump: d
Page 27 and 28: Solution: VolRip • Python→Perl
Page 29 and 30: VolRip Example: Tracking USB Keys $
Page 31 and 32: Caveats • Since analysis is done
Page 33: ? Thanks! • To you all, for liste