The Wisdom of the Heap: Mesh It up by Weaving Data Structures

In this short presentation, Trufflepig Forensics’ Aaron Hartel and Christian Müller present some early stage research about the volatility of data in memory as data structures change version to version.

Session Chair: We’re now going over … Continue reading The Wisdom of the Heap: Mesh It up by Weaving Data Structures

Memory Forensic Analysis of a Programmable Logic Controller in Industrial Control Systems

Winner of the Best Student Paper Award at DFRWS-EU 2022! Muhammad Haris Rais describes a step-wise approach to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. By following a methodology that… Continue reading Memory Forensic Analysis of a Programmable Logic Controller in Industrial Control Systems

PEM: Remote Forensic Acquisition of PLC Memory in Industrial Control Systems

https://youtu.be/_pPxk5eTH_Y

Winner of the Best Paper Award at DFRWS-EU 2022, Nauman Zubair proposes a new memory acquisition framework to remotely acquire a programmable logic controller (PLC)’s volatile memory while the PLC is controlling a phys… Continue reading PEM: Remote Forensic Acquisition of PLC Memory in Industrial Control Systems

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

In this video from DFRWS-EU 2022, Jenny Ottmann revisits the discussion on quality criteria for “forensically sound” acquisition of such storage and proposes a new way to capture the intent to acquire an instantaneous snapshot from a single targe… Continue reading Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

Extraction and Analysis of Retrievable Memory Artifacts From Windows Telegram Desktop Application

In this video from DFRWS-EU 2022, Pedro Fernandez-Alvarez describes research focused on the Telegram Desktop client, in particular the client process contents in a Windows system’s RAM.

Session Chair: We are now in the topic of memory f… Continue reading Extraction and Analysis of Retrievable Memory Artifacts From Windows Telegram Desktop Application

Magnet Forensics Acquires Cybersecurity Software Firm Comae Technologies

The company will continue the development of Comae’s memory analysis platform and seek to incorporate its capabilities into existing solutions

Magnet Forensics announced the acquisition of the strategic IP assets of Comae Technologies, a cybersecurit… Continue reading Magnet Forensics Acquires Cybersecurity Software Firm Comae Technologies

DFRWS-EU 2022: The Future of Digital Forensics Is Now

Moving digital forensics forward in terms of methods and frameworks, as well as organizational and cross-cultural collaboration, was an overarching theme of this year’s European Union edition of the Digital Forensics Research Workshop (DFRWS). 

Continue reading DFRWS-EU 2022: The Future of Digital Forensics Is Now

Is More Efficient, Accessible Memory Forensics Possible?

Christa: Memory forensics is a mainstay of incident response. Its relevance and necessity only growing with time, as encryption technology has become more integrated, especially in consumer devices. Yet memory forensics is neither intuitive nor… Continue reading Is More Efficient, Accessible Memory Forensics Possible?