Native Memory Forensics

Among different approaches to memory forensics¹³, native memory forensic analysis is done using native OS debuggers such as WinDbg from Debugging Tools for Windows or GDB (Linux) or GDB/LLDB (Mac OS X). Such approach is an integral part of software diagnostics (investigation of signs of software structure and behavior in software execution artifacts). We introduced it as a part of pattern-oriented software forensics¹⁴.

Software Diagnostics Services offers a comprehensive self-paced training course in native memory forensics for Windows platforms¹⁵ using WinDbg and memory dumps for hands-on exercises¹⁶. This training course¹⁷ teaches various pattern languages¹⁸ that can be used with other memory forensic analysis tools.

¹³ Investigation of past system or process structure and behaviour recorded in memory snapshots.

¹⁴ http://www.patterndiagnostics.com/pattern-oriented-software-forensics-materials

¹⁵ Windows XP, Windows Vista, Windows 7, Windows 8, Windows RT, Windows Server

¹⁶ http://www.patterndiagnostics.com/memory-forensics-pack

¹⁷ Also includes malware and rootkit detection, disassembly and reversing as an integral part of forensic investigation.

¹⁸ Such as memory analysis pattern language, malware analysis patterns, and ADDR patterns.