Ever since Internet traffic became an extensively monetizable commodity, bad actors have been focused on intercepting it to generate profit. Unsuspecting users’ devices, including computers and smartphones, are on the receiving end of this exploitation. Macs are in the same boat – moreover, they appear to be targeted the most....
Announcing the BETA release of DAMM, a FOSS memory analysis platform built on top of Volatility Memory analysis is the new(-ish) big thing in the incident response, malware analysis, digital forensics space for the moment, and so all the cool kids seem to be doing it. While memory analysis is...
Recently, we had the pleasure to join David Cowen on several episodes of his weekly show Forensic Lunch. In this particular episode on Youtube, we discussed some of our recent research on discovering previously unknown Windows registry values with embedded timestamp information. As promised, we are releasing our script to...
Introduction In this blog post we will be demonstrating a new feature to the Dalvik Inspector tool, which we are planning on releasing this summer at Black Hat USA. Specifically we have added functionality to the Dalvik Inspector GUI for automatic Volatility plugin creation. To accomplish this, we have developed...
Current analysis methods for images of RAM are limited in that they are designed to analyze a single memory image at a time. When attempting to analyze malware, it is a common technique to spin up a clean VM, infect it with that malware and then acquire a snapshot of...
Introduction In this blog post, we will be presenting new functionality that will be incorporated into the next major Volatility release after version 2.3. This functionality allows for deep analysis of application internals on the Android operating system. All Android applications, such as those downloaded from Google Play, are powered...
We’ve just gotten back from RSA Security in San Francisco. The talk went great as it seemed there were a few hundred people in the room. The jist of the presentation was that registry forensics can be useful for more than just standard forensics investigations. Co-Founder, Dr. Lodovico Marziale, went...
Although not yet nearly as widespread as the Windows platform, Mac OS X-based machines are quickly gaining market share, and are now commonly seen in real-world investigations. While some research exists for analysis on this platform, almost none exists for deep parsing of the Spotlight index, which is used by...
Dalvik is the process Virtual Machine used by Android that powers all non-native applications used on Android devices. Through Dalvik memory analysis, a wealth of insight can be gained into the workings of a running application, including all instantiated objects (classes) and the variables, methods, and other per-instance class information....
Full Text Android Memory Capture and Applications for Security and Privacy, University of New Orleans 2011 Abstract The Android operating system is quickly becoming the most popular platform for mobile devices. As Android’s use increases, so does the need for both forensic and privacy tools designed for the platform. This...