Physical Memory Analysis of Live CD systems

At the recent Black Hat DC 2011 security briefing a presentation was given by Andrew Case on techniques to analyse systems running from bootable Live CD such as TAILS & Backtrack.

The whitepaper and slides are available from

https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing_Live_CDs-wp.pdf

https://media.blackhat.com/bh-dc-11/Case/BlackHat_DC_2011_Case_De-Anonymizing%20Live%20CDs-Slides.pdf

Further items of interest such as data exfiltration may be found in the archives at http//www.blackhat.com/html/bh-dc-11/bh-dc-11-archives.html