Difference between pages "Windows Memory Analysis" and "Talk:Carver 2.0 Planning Page"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
(Consolidation)
 
Line 1: Line 1:
Analysis of [[physical memory]] from [[Windows]] systems can yield significant information about the target operating system. This field is still very new, but holds great promise.
+
License: have we even discussed a license yet?  Who chose it?  I'm not terribly opposed to a 3-clause BSD, but...? - [[User:RB|RB]] 00:39, 30 October 2008 (UTC)
  
== Sample Memory Images ==
+
[[User:Joachim Metz|Joachim]] I prefer the LPGL it's restricts the usage of the code somewhat more. When its integrated in other (closed source) tooling which is published, they must publish that the tool uses this code.
  
Getting started with memory analysis can be difficult without some known images to practice with.  
+
:: LGPL?
 +
:: [[User:.FUF|.FUF]] 19:40, 31 October 2008 (UTC)
 +
:: [[User:Joachim Metz|Joachim]] GNU Library or "Lesser" General Public License (LGPL) (http://www.opensource.org/licenses/alphabetical)
 +
:::: ''Joachim I prefer the LPGL'' :) [[User:.FUF|.FUF]] 19:51, 31 October 2008 (UTC)
 +
:::::: [[User:Joachim Metz|Joachim]] To quote Homer Simpson "Doh!"
 +
:: Agreed.  I sit on the fence between BSD and GPL: the business half of me agrees that open licensing should place as few restrictions or qualifications as possible, whereas the idealist/OSS side wants to ensure the project's freedom.  The LGPL is a more reasonable balance, encouraging widespread use but ensuring modifications' freedom. [[User:RB|RB]] 16:59, 1 November 2008 (UTC)
  
* The 2005 [[Digital Forensic Research Workshop]] [http://www.dfrws.org/2005/challenge/ Memory Analysis Challenge] published two Windows 2000 Service Pack 1 memory images with some [[malware]] installed.
+
== Consolidation ==
  
* The [http://dftt.sourceforge.net/ Digital Forensics Tool Testing] project has published a few [http://dftt.sourceforge.net/test13/index.html Windows memory images].
+
We've got a '''lot''' of good ideas here, but in interest of not stepping on anyone's toes, it's getting rather disjointed and hard to read.  Is anyone willing to (or allow me to) try to consolidate them into some sort of coherency?  I'd like at least one of the admins ([[User:.FUF|.FUF]] or [[User:Simsong|Simsong]] to concur before anyone moves forward. I know the wiki way is to just let it grow, but even watching each addition I'm starting to have trouble visualizing where we are. [[User:RB|RB]]
  
== See Also ==
+
:: That's good idea, but it is important to consolidate without losing the ideas and opinions. I think it's better for this page to enter some "stable" branch. And then we'll move to the next phase. What do you think, [[User:Simsong|Simsong]]? [[User:.FUF|.FUF]] 18:12, 1 November 2008 (UTC)
* [[Pagefile.sys]]
+
  
== History ==
+
::: One option could be to break each major section into its own page so it can be properly discussed without clutter, then transclude each to this page.  A dedicated namespace would probably be overkill, but since we're throwing out ideas should at least be mentioned.  --[[User:RB|RB]] 19:03, 1 November 2008 (UTC)
  
During the 1990s, it became a [[best practice]] to capture a [[Tools:Memory_Imaging|memory image]] during [[Incident Response|incident response]]. At the time, the only way to analyze such memory images was using [[strings]]. Although this method could reveal interesting details about the memory image, there was no way to associate what data came from what program, let alone what user.
+
:::: [[User:Joachim Metz|Joachim]] Separate the parts into topics. Have a discussion and an informational part per topic.
 
+
In the summer 2005 the [[Digital Forensic Research Workshop]] published a ''Memory Analysis Challenge''. They distributed two memory images and asked researchers to answer a number of questions about a security incident. The challenge produced two seminal works. The first, by [[Chris Betz]], introduced a tool called [[memparser]]. The second, by [[George Garner]] and [[Robert-Jan Mora]] produced [[kntlist]].
+
 
+
At the [[Blackhat (conference)|Blackhat Federal]] conference in March 2007, [[AAron Walters]] and [[Nick Petroni]] released a suite called [[volatools]]. Although it only worked on [[Windows XP]] Service Pack 2 images, it was able to produce a number of useful data.
+

Revision as of 04:45, 2 November 2008

License: have we even discussed a license yet? Who chose it? I'm not terribly opposed to a 3-clause BSD, but...? - RB 00:39, 30 October 2008 (UTC)

Joachim I prefer the LPGL it's restricts the usage of the code somewhat more. When its integrated in other (closed source) tooling which is published, they must publish that the tool uses this code.

LGPL?
.FUF 19:40, 31 October 2008 (UTC)
Joachim GNU Library or "Lesser" General Public License (LGPL) (http://www.opensource.org/licenses/alphabetical)
Joachim I prefer the LPGL :) .FUF 19:51, 31 October 2008 (UTC)
Joachim To quote Homer Simpson "Doh!"
Agreed. I sit on the fence between BSD and GPL: the business half of me agrees that open licensing should place as few restrictions or qualifications as possible, whereas the idealist/OSS side wants to ensure the project's freedom. The LGPL is a more reasonable balance, encouraging widespread use but ensuring modifications' freedom. RB 16:59, 1 November 2008 (UTC)

Consolidation

We've got a lot of good ideas here, but in interest of not stepping on anyone's toes, it's getting rather disjointed and hard to read. Is anyone willing to (or allow me to) try to consolidate them into some sort of coherency? I'd like at least one of the admins (.FUF or Simsong to concur before anyone moves forward. I know the wiki way is to just let it grow, but even watching each addition I'm starting to have trouble visualizing where we are. RB

That's good idea, but it is important to consolidate without losing the ideas and opinions. I think it's better for this page to enter some "stable" branch. And then we'll move to the next phase. What do you think, Simsong? .FUF 18:12, 1 November 2008 (UTC)
One option could be to break each major section into its own page so it can be properly discussed without clutter, then transclude each to this page. A dedicated namespace would probably be overkill, but since we're throwing out ideas should at least be mentioned. --RB 19:03, 1 November 2008 (UTC)
Joachim Separate the parts into topics. Have a discussion and an informational part per topic.