Second Look - Revision history

Joachim Metz: /* External Links */

2012-07-31T04:59:21Z

‎External Links

Joachim Metz at 09:54, 27 July 2012

2012-07-27T09:54:06Z

Joachim Metz at 09:52, 27 July 2012

2012-07-27T09:52:27Z

Joachim Metz: moved Second Look: Linux Memory Forensics to Second Look

2012-07-27T09:50:37Z

moved Second Look: Linux Memory Forensics to Second Look

Joachim Metz at 09:22, 27 July 2012

2012-07-27T09:22:21Z

Joachim Metz at 09:21, 27 July 2012

2012-07-27T09:21:35Z

Andrewtappert at 14:53, 17 April 2012

2012-04-17T14:53:16Z

Andrewtappert at 20:39, 26 May 2011

2011-05-26T20:39:56Z

Andrewtappert at 20:36, 26 May 2011

2011-05-26T20:36:56Z

Andrewtappert: Created page with "File:second_look_logo.jpg The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effect..."

2011-05-26T20:35:35Z

Created page with "File:second_look_logo.jpg The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effect..."

New page

[[File:second_look_logo.jpg]]

The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.

== Memory Acquisition ==
Second Look™ preserves the volatile system state, capturing evidence and information that does not exist on disk and may otherwise be lost as an investigation proceeds. A command-line script allows for acquisition of memory from running systems without introducing any additional software. A memory access driver is provided for use on systems without a native interface to physical memory.

== Memory Analysis ==
Second Look™ interprets live system memory or captured memory images, detecting and reverse engineering malware, including stealthy kernel rootkits and backdoors. A kernel integrity verification approach is utilized to compare the Linux kernel in memory with a reference kernel. Pikewerks provides thousands of reference kernels derived from original distribution kernel packages, and a script for creating reference kernels for other systems, such as those running custom kernels.

== Supported Systems ==
Second Look™ is regularly updated to support analysis of the latest kernels and the most commonly used Linux distributions. The following are its capabilities as of May 2011:
* Supported target kernels: 2.6.8 - 2.6.38
* Supported target architectures: x86 32- and 64-bit
* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-11.04, and more!

← Older revision		Revision as of 04:59, 31 July 2012
Line 29:		Line 29:
	== External Links ==		== External Links ==
	* [http://secondlookforensics.com Second Look®]		* [http://secondlookforensics.com Second Look®]
−	* [http://secondlookforensics.com/linux-memory-images/ Linux Memory Images]

← Older revision		Revision as of 09:54, 27 July 2012
Line 29:		Line 29:
	== External Links ==		== External Links ==
	* [http://secondlookforensics.com Second Look®]		* [http://secondlookforensics.com Second Look®]
		+	* [http://secondlookforensics.com/linux-memory-images/ Linux Memory Images]

@@ Line 1: / Line 1: @@
 {{Infobox_Software |
-   name = Volatility |
+   name = Second Look |
-   maintainer = Raytheon Pikewerks |
+   maintainer = [[Raytheon Pikewerks Corporation]] |
    os = {{Linux}} |
    genre = {{Memory analysis}} |
@@ Line 11: / Line 11: @@
 The Incident Response edition of '''Second Look®: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.
 == Memory Acquisition ==
@@ Line 27: / Line 28: @@
 == External Links ==
-Second Look® is a product of [[Raytheon Pikewerks Corporation]]:
+* [http://secondlookforensics.com Second Look®]
-* http://secondlookforensics.com

@@ Line 3: / Line 3: @@
    maintainer = Raytheon Pikewerks |
    os = {{Linux}} |
-   genre = [[Memory analysis]] |
+   genre = {{Memory analysis}} |
    license = commercial |
    website = [http://secondlookforensics.com/ secondlookforensics.com/] |

← Older revision		Revision as of 09:21, 27 July 2012
Line 1:		Line 1:
		+	{{Infobox_Software \|
		+	name = Volatility \|
		+	maintainer = Raytheon Pikewerks \|
		+	os = {{Linux}} \|
		+	genre = [[Memory analysis]] \|
		+	license = commercial \|
		+	website = [http://secondlookforensics.com/ secondlookforensics.com/] \|
		+	}}
		+
	[[File:second_look_logo.png]]		[[File:second_look_logo.png]]

@@ Line 1: / Line 1: @@
 [[File:second_look_logo.png]]
-The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.
+The Incident Response edition of '''Second Look®: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.
 == Memory Acquisition ==
-Second Look™ preserves the volatile system state, capturing evidence and information that does not exist on disk and may otherwise be lost as an investigation proceeds.  A command-line script allows for acquisition of memory from running systems without introducing any additional software.  A memory access driver is provided for use on systems without a native interface to physical memory.
+Second Look® preserves the volatile system state, capturing evidence and information that does not exist on disk and may otherwise be lost as an investigation proceeds.  A command-line script allows for acquisition of memory from running systems without introducing any additional software.  A memory access driver is provided for use on systems without a native interface to physical memory.
 == Memory Analysis ==
-Second Look™ interprets live system memory or captured memory images, detecting and reverse engineering malware, including stealthy kernel rootkits and backdoors.  A kernel integrity verification approach is utilized to compare the Linux kernel in memory with a reference kernel.  Pikewerks provides thousands of reference kernels derived from original distribution kernel packages, and a script for creating reference kernels for other systems, such as those running custom kernels.
+Second Look® interprets live system memory or captured memory images, detecting and reverse engineering malware, including stealthy kernel rootkits and backdoors.  A kernel integrity verification approach is utilized to compare the Linux kernel in memory with a reference kernel.  Pikewerks provides thousands of reference kernels derived from original distribution kernel packages, and a script for creating reference kernels for other systems, such as those running custom kernels.
 == Supported Systems ==
-Second Look™ is regularly updated to support analysis of the latest kernels and the most commonly used Linux distributions.  The following are its capabilities as of May 2011:
+Second Look® is regularly updated to support analysis of the latest kernels and the most commonly used Linux distributions.  The following are its capabilities as of April 2012:
-* Supported target kernels: 2.6.8 - 2.6.38
+* Supported target kernels: 2.6.x, 3.x up to 3.2
 * Supported target architectures: x86 32- and 64-bit
-* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-11.04, and more!
+* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more!
 == External Links ==
-Second Look™ is a product of [[Pikewerks Corporation]]:
+Second Look® is a product of [[Raytheon Pikewerks Corporation]]:
-* http://www.pikewerks.com/sl/
+* http://secondlookforensics.com

← Older revision		Revision as of 20:39, 26 May 2011
Line 14:		Line 14:
	* Supported target architectures: x86 32- and 64-bit		* Supported target architectures: x86 32- and 64-bit
	* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-11.04, and more!		* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-11.04, and more!
		+
		+	== External Links ==
		+	Second Look™ is a product of [[Pikewerks Corporation]]:
		+	* http://www.pikewerks.com/sl/

← Older revision		Revision as of 20:36, 26 May 2011
Line 1:		Line 1:
−	[[File:second_look_logo.~~jpg~~]]	+	[[File:second_look_logo.png]]

	The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.		The Incident Response edition of '''Second Look™: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.