#Prodiscover basic education edition pdf
#Prodiscover basic education edition drivers
#Prodiscover basic education edition driver
#Prodiscover basic education edition full

identify hooks (often used by rootkits) in the System Call Table, the Interrupt Descriptor Tables (IDTs), and driver function tables (IRP tables).identify all loaded kernel modules by walking a linked list.report device and driver layering, which can be used to intercept network packets, keystrokes and file activity.

#Prodiscover basic education edition drivers

identify all drivers loaded in memory, including those hidden by rootkits.

output all strings in memory on a per process basis.

list all network sockets that the process has open, including any hidden by rootkits.

displaying all allocated portions of the heap and execution stack.

list the virtual address space of a given process including:.

report all open handles in a process (for example, all files, registry keys, etc.).

enumerate all running processes (including those hidden by rootkits).

image a specified driver or all drivers loaded in memory to disk.

This includes a processвЂ™ loaded DLLs, EXEs, heaps, and stacks.

image a processвЂ™ entire address space to disk.

#Prodiscover basic education edition full

image the full range of system memory (not reliant on API calls).

Memoryze can acquire and/or analyze memory images, and on live systems can include the paging file in its analysis. MANDIANT Memoryze is free memory forensic software that helps incident responders find evil in live memory. From their product description page linked.

MANDIANT Memoryze вЂ“ From the geniuses at Mandiant.

#Prodiscover basic education edition pdf

Nigiliant32 runs as a single exe file.ДЇor specific information see the PDF guide Nigilant32 For First Responders: Active Memory Imaging, вЂњUsing Nigilant32 we can image the active physical memory (RAM) of the suspect workstation or server to secure portable media.вЂќ

Nigilant32 вЂ“ Developed by Agile Risk Management LLC.The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.вЂќДЇor the current news and info on Volatility and many other memory and forensics related topics, please see this quite active blog on Tumbler: Volatility The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. вЂќThe Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. Volatility | Memory Forensics вЂ“ From the page:.

Please notice ALL (32-bits + 64-bits, driver + executable) windd binaries are digitally signed to confirm they are from a trusted source.вЂќ 'Windd is a free Windows utility, by Matthieu Suiche, which aims at being used as a swiss-knife to acquire the physical memory by investigators, incident responses engineers, malware analysts, system administrators and kernel developpers.

WinDD вЂ“ crafted and updated with love and passion by Matthieu Suiche.

Probably nothing much new here to find by the pros, itвЂ™s more of my own roundup in case I loose my USB utility driveвЂ¦. In the meantime, for reference purposes, here is a short list of some freeware tools and utilities I have on the old USB stick that can all do memory captures of Windows systems (or are useful from a memory analysis perspective). Then there is that forensics вЂњHeavy EditionвЂќ Linkfest that will I hope wonвЂ™t take an HRT to get out the door. IвЂ™m still sitting on a USMT-GUI post that IвЂ™ve got to add to a fire-sale post. Some stuff acquired by dear friend TinyApps.Org Blog regarding Read-Only Honoring of USB media. Then there is some WinPE 3.0 & DISM notes. IвЂ™ve got a massive вЂњnew & improvedвЂќ round-up linkfest bursting at the seams. Due to the recent rounds of troubleshooting, the posts lately havenвЂ™t been the meaty material IвЂ™ve been setting aside.