Uncategorized
Lab – Memory Forensics:For this lab, you will be examining the contents of a random access memory (RAM) dump.The Software Engineering Institute (SEI) produced a good paper comparing live responsewith analysis of a memory image:http://www.sei.cmu.edu/library/abstracts/reports/08tn017.cfmWith a physical system, you will need to use a tool like Encase, FTK Imager, or Mandiant’sMemoryze™ tool to create an image of volatile memory. If you’re working with a VirtualMachine (VM), you can simply create a snapshot and conduct an analysis on the resultant.vmem file.Complete the following steps on the Lab VM or your own workstation. Thesetools are already installed on the VM. You’ll need to download them yourself if you’re usinga custom workstation:Volatility: https://code
Lab – Memory Forensics:For this lab, you will be examining the contents of a random access memory (RAM) dump.The Software Engineering Institute (SEI) produced…