An Introduction to VolUtility
Basil Alawi S.Taher has posted a nice overview of how to start using VolUtility – a web frontend for Volatility framew…
Volatility Memory Analysis: Building Linux Kernel Profiles
Joshua James has published a video-tutorial on how to build Linux kernel profiles for memory forensics with Volatility. He n…
Volatility Workbench Beta
PassMark Software has released a beta version of Volatility Workbench – a graphical user interface (GUI) for the Volat…
Introduction to Memory Forensics
Richard Davis has posted a video introduction to memory forensics, which includes a sample exercise using Volatility 2.6 to …
The new version of Mandiant Redline supports Windows 10
Redline version 1.20 introduces support for collection from and analysis of Window 10 systems and is already available for d…
Join our Telegram DFIR group!
Guys, we have created a Telegram group, where we will do our best to answer all your questions. We will be very happy if you…
Is Fileless Malware Really Fileless?
Travis Smith has published a post about fileless malware on The State of Security. He notes that this type of malware isn…
Running Executables on macOS From Memory
Stephanie Archibald from Cylance has written an article about the execution of multi-stage payloads on Mac OS X (up to Sierr…
HyperLink: Virtual Machine Introspection and Memory Forensic Analysis without Kernel Source Code
Virtual Machine Introspection (VMI) is an approach to inspecting and analyzing the software running inside a virtual machine…
Live Forensics & Memory Analysis
So you think you might have a compromised Windows system. If you do, where do you start? How would you review the memory of …
