I will be giving a short half hour talk titled “Recent developments in volatile memory forensics” at the Brisbane Computer Security Day on Friday 29th November, 2007. In this talk I will be giving an overview of where volatile memory forensics fits into the general practice of forensics, identify the benefits and limitations of the current toolset, and outline the current developments in the field. The subjects of other talks include PCI data security, google hacking, and web application security.
This event has been organised by the Information Security Insititue, the Australian Information Security Association and AUSCERT.
My paper “BodySnatcher: towards reliable volatile memory acquisition by software” has been accepted at the 2007 Digital Forensics Research Workshop (DFRWS) conference in August this year. The abstract is below:
Recently there has been a surge in interest in memory forensics: the acquisition and analysis of the contents of physical memory obtained from live hosts. The emergence of kernel level rootkits, anti-forensics, and the threat of subversion that they pose, threatens to undermine the reliability of such memory images, and digital evidence in general. In this paper we propose a method of acquiring the contents of volatile memory from arbitrary operating systems in a manner that provides point in time atomic snapshots of the host OS volatile memory. Additionally the method is more resistant to subversion due to its reduced attack surface. Our method is to inject an independent, acquisition specific OS into the potentially subverted host OS kernel, snatching full control of the host’s hardware. We describe an implementation of this proposal, which we call BodySnatcher, which has demonstrated proof of concept by acquiring memory from Windows 2000 operating systems.