Introduction to Redline

As a continuation of the “Introduction to Memory Forensics” series, Richard Davis taking a look at Redline – a free analysis tool from FireEye that allows us to analyze a potentially compromised Windows system. Redline can collect memory and disk-based artifacts, including all running processes and drivers from memory, file system metadata, registry data, event logs, network information, services, tasks, and web history. The software provides an easy-to-use GUI interface that can help us analyze the collected data to find evil on a given system. You’ll start with an overview of Redline collectors, and then you’ll create a collector and save it to a USB flash drive. You’ll then run that collector on your target Windows 10 VM and bring the results back to the analysis VM where you’ll briefly look at each category of collected forensic data.