Challenge of Windows physical memory acquisition and exploitation

(Honolulu, HW) – Here is a quick post to provide ressources presented this afternoon at Shakacon 2009.
This talks aims at showing to win32dd users (forensics engineers, investigators, incident response engineers, ..) why physical memory analysis is important, and mainly covers how to rethink memory acquisition and exploitation in a more efficient way.

Slides are available here. Not rocket science but very interesting to see how efficient results can be obtained if we put different exciting and performant technologies together.

PowerShell script used to retrieve erased EPROCESS entries from PspCidTable is available here.

Figure 1 – Screenshot of the powershell script in action
Magic command (.\FUto.ps1 | Out-GridView)

And here is win32dd v1.2.1.20090608 – If you want more information about the update go here.

PS. Do not copy win32dd in the System32 directory and run it as Administrator. I think I’ll write a HOWTO document soon.