ADDITIONAL RESOURCES
Lecture Slides
Memory AcquisitionDevice Acquisition
Web Resources
MoonSols Windows Memory ToolkitMemory (Examples of using the Volatility Framework), Sketchymoose's BlogGoogle Rapid Response (GRR) documentationLest We Remember: Cold Boot Attacks on Encryption Keys, J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten. Proc. 17th USENIX Security Symposium (Sec ’08), San Jose, CA, July 2008.Windows Artifact Analysis: Evidence of... (PDF poster), Rob Lee and the SANS DFIR Faculty, ©2012 SANS. See the middle row for program execution evidence.
转载于:https://www.cnblogs.com/sec875/articles/10015677.html
