SPbCTF Pro — Memory Dump Analysis in Volatility
In the SPbCTF Pro series, we have collected our videos that cover more professional skills than our seasons for beginners. This release is about forensics, from training for WorldSkills in the summer of 2019.
* *
Day 4 — forensics of RAM images.
Images: http://big.vos.uz/WStrain_memory.7z.t... password: HqARTCn477dsrQJe
0:00 Volatility. Profile definition
7:28 Processes (pslist)
9:25 Network connections (netscan)
12:28 Timeline (timeliner)
13:32 Clipboard
14:50 Service list (svcscan)
17:15 Registry carving (dumpregistry)
18:14 File carving (mftparser, R-Studio, dumpfiles)
26:12 Process mining (procdump, memdump, cmdline, ...)
41:04 File carving inside process memory (binwalk)