MoVP II – 2.3 – Creating Timelines with Volatility
by Jamie Levy | May 23, 2013 | forensics, grrcon, malware, movp, timelines, windows
A common computer forensic investigative methodology is creating timelines. Timelines help establish events that took place on the machine prior to investigation. There are various artifacts in Windows memory that can be used to construct a timeline....Reverse Engineering Poison Ivy’s Injected Code Fragments
by Volatility | Oct 16, 2012 | code injection, distorm, forensics, grrcon, malware, poison ivy, volatility, windows
This is an addendum to GrrCon Network Forensics Challenge with Volatility. In the initial post we covered the basics – the what, the when, and the how. We found strings in memory, such as the mutex name, the registry Run key, and the svchosts.exe file name; then...Solving the GrrCon Network Forensics Challenge with Volatility
by Volatility | Oct 11, 2012 | forensics, grrcon, malware, volatility, windows
In this post, we will walk through the process that MHL (@iMHLv2) and I (@attrc) went through to solve the @GrrCon network forensics challenge. Although participants were provided a memory sample, packet capture, and file system timeline, as a personal challenge our...
You must be logged in to post a comment.