MoVP 4.3 Recovering Master Boot Records (MBRs) from Memory
by Jamie Levy | Oct 3, 2012 | malware, movp, volatility, windows
Month of Volatility Plugins Given that we are still recovering from an amazing Open Memory Forensics Workshop, today’s post will continue the theme of short and sweet. This post will focus on recovering interesting disk artifacts from memory. In particular, it...MoVP 4.2 Taking Screenshots from Memory Dumps
by Volatility | Oct 2, 2012 | forensics, kernel, malware, movp, volatility, windows
Month of Volatility Plugins Open Memory Forensics Workshop 2012 is currently in progress, thus today’s MoVP post will be short and sweet. However, it will still introduce an exciting new capability exclusive to Volatility. One of Brendan Dolan Gavitt’s early...MoVP 4.1 Detecting Malware with GDI Timers and Callbacks
by Volatility | Oct 1, 2012 | forensics, kernel, malware, movp, volatility, windows
Month of Volatility Plugins Nearly a year ago, Volatility became the first (and to this date, the only) memory forensics framework to analyze kernel timers for malware analysis. The timers plugin was introduced in two of my older blog posts: ZeroAccess,...
You must be logged in to post a comment.