Digital forensics and incident response (DFIR)

Memory forensics ties into many disciplines in cyber investigations. From the classical investigations that focus on user artifacts via malware analysis to large-scale hunting, memory forensics has many applications in security operations.

---

Windows forensics

• Introduction
• A Windows server
• Organisation X desktop

Linux forensics

• Introduction
• Persistence mechanisms
• Evidence of execution
• Log files

RedLine

• Introduction
• Standard Collector Analysis
• IOC Search Collector
• IOC Search Collector Analysis
• Endpoint investigation

Tools in a nutshell

• Introduction
• Autopsy
• KAPE in a nutshell
• Volatility
• Velociraptor in a nutshell
• TheHive Project

Challenges

• Introduction
• Leaking private company data (again)
• Windows 10 disk image
• Acceptable Use Policy violation
• BOB! THIS ISN’T A HORSE!
• That Kind of Hurt my Feelings
• Hunt for a nightmare

---