Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
555
Views
Topic starter
16/10/2015 9:48 am
Hi,
I'm beginner in forensics and i would like to have your advice on the following case.
Let's say an incident occurred inside the organization and we know what tool the disgruntled employee used to attack one of our servers. Let's say we acquired the RAM image and a bunch of other volatile data from the live system
My question is the following
Should we try to dump the process used to attack our network with a utility like procdump or should we instead work on the RAM image and try to extract the process dump from the RAM image?
18/10/2015 1:19 am
Work on the complete memory dump. Volatility may become your new best friend in this case. You can analyze any malicious process and dump out the executables from it.
best regards,
Robin