Name
Memory Forensics: Using Memory Forensics Analysis to Guide Your Investigation
Speakers
Aaron Sparling | Computer Forensic Examiner | Portland Police Bureau
Description
Digital forensic backlogs are growing at a pace which makes it difficult for labs and examiners to keep up. Traditional methods of acquisition and analysis can be time and resource intensive. Applying a triage methodology into the forensic workflow and conducting targeted analysis can drastically reduce the amount of time the examiner spends per case. By implementing memory forensics in the early stages of the analysis process, the examiner will be able to quickly build a profile of the user, as well as locate indicators or artifacts which may be on the file system. Memory forensics can be used to track user activity, identify external devices, build user timelines, conduct registry analysis, identify applications and files the user may have accessed, locate passwords, recover network artifacts and much more. Memory acquisition and analysis is extremely fast and efficient when done properly and when the examiner implements a targeted approach. This presentation will walk through numerous memory analysis techniques using volatility, bulk extractor, page_brute, strings, YARA and hashcat, which can be implemented into the examiners existing workflow to speed up the process and reduce backlogs.