Difference between pages "Category:Live CD" and "Memory analysis"
From Forensics Wiki
(Difference between pages)
Joachim Metz (Talk | contribs) |
|||
| Line 1: | Line 1: | ||
| − | + | '''Memory Analysis''' is the science of using a [[Tools:Memory Imaging|memory image]] to determine information about running programs, the [[operating system]], and the overall state of a computer. Because the analysis is highly dependent on the operating system, we have broken it into subpages: | |
| − | ''' | + | |
| − | + | ||
| − | + | * [[Windows Memory Analysis]] | |
| − | * [[ | + | * [[Linux Memory Analysis]] |
| − | [[ | + | == Encryption Keys == |
| + | |||
| + | Various types of encryption keys can be extracted during memory analysis. | ||
| + | You can use [[AESKeyFinder]] to extract 128-bit and 256-bit [[AES]] keys and [[RSAKeyFinder]] to extract all private and public [[RSA]] keys from a memory dump [http://citp.princeton.edu/memory/code/]. [http://jessekornblum.com/tools/volatility/cryptoscan.py cryptoscan.py] ([[List of Volatility Plugins|plugin for the Volatility memory analysis framework]]) scans a memory image for [[TrueCrypt]] passphrases. | ||
| + | |||
| + | == See Also == | ||
| + | |||
| + | * [[Tools:Memory Imaging]] | ||
| + | * [[Tools:Memory Analysis]] | ||
Revision as of 13:04, 24 January 2009
Memory Analysis is the science of using a memory image to determine information about running programs, the operating system, and the overall state of a computer. Because the analysis is highly dependent on the operating system, we have broken it into subpages:
Encryption Keys
Various types of encryption keys can be extracted during memory analysis. You can use AESKeyFinder to extract 128-bit and 256-bit AES keys and RSAKeyFinder to extract all private and public RSA keys from a memory dump [1]. cryptoscan.py (plugin for the Volatility memory analysis framework) scans a memory image for TrueCrypt passphrases.
See Also
Pages in category "Live CD"
The following 27 pages are in this category, out of 27 total.
BCDFGH |
KLMP |
P cont.RSTW |
