lime in the coconut Android Forensics with volatility and LiME - Andrew Case

Android powered phones dominate the mobile phone market, and Android powered devices, such as tablets, E-readers, and netbooks, have substantial shares in their respective markets. The ability of the forensics community to perform deep forensic analysis of Android devices is essential and will become a desirable skill of all forensics investigators. In this presentation, Andrew Case walks through new research into memory forensics against Android devices and discuss its application to real investigations. These capabilities include:

- Capturing physical memory from the devices
- Memory analysis of in-kernel data structures related to processes, memory maps, network connections, and more
- Memory analysis of Android's application virtual machine, Dalvik, in order to perform deep recovery of application-specific information
- Recovery of the tmpfs in-memory filesystem in order to recover the data store used by many applications to hold artifacts such as browser caches and configuration options

Combined, these capabilities provide the investigator with the ability to recover a wealth of runtime information and to gain deep insight into both the actions that were occurring on the phone when the memory capture was taken as well as historical actions.

The Volatility memory analysis framework will be used to showcase these forensics capabilities. Volatility is an open source project, written in Python, that allows investigators to write plugins capable of deep memory analysis. All of the functionality and plugins covered in the talk will be available on the Volatility Google code page for download.

Links from the presentation: [1] http://code.google.com/p/lime-forensics/ [2] http://www.memoryanalysis.net/researc... [3] http://volatility-labs.blogspot.com/2... [4] http://volatility-labs.blogspot.com/2... [5] http://code.google.com/p/volatility/w... [6] http://code.google.com/p/volatility/w... [7] http://volatility-labs.blogspot.com/

Andrews blog:
http://memoryforensics.blogspot.com/

---------------------

DFIROnline is a monthly online meeting of digital forensic and incident response professionals. The purpose of these meetups is to enable information sharing among the DFIR community. These session are open to anyone, and occur on the third Thursday of every month at 2000 US eastern time. If you would like to get involved and present something please email meetup at writeblocked.org.

If you would like to recieve emails about the schedule and upcoming events you can subscribe to the DFIROnline mailing list http://mail.writeblocked.org/mailman/.... The list is only used for announcements and reminders and should not generate more than a few emails a month. The schedule of upcoming events is at: http://www.writeblocked.org/dfironlin...

lime in the coconut Android Forensics with volatility and LiME - Andrew Case
42 Likes	42 Dislikes
8,533 views views	698 followers
Science & Technology	Upload TimePublished on 9 Dec 2012

Related keywords

digital forensics framework download,android forensics andrew hoog pdf,computer forensics in hindi,volatility swap,mobile alabama,volatility traduzione,lime player,mike wilkinson alejo y valentina,file systems vs dbms,android forensics cheat sheet,mobile forensics central,file systems supported by linux,mobile car detailing,mobile forensics cookbook pdf,computer forensics certification,android operating system named for a cookie,mobile forensics advances challenges and research opportunities,limelight fitness,android operating system pdf,file systems supported by android,digital forensics pdf,limerick ireland,mobile homes,registry target,mobile patrol,mobile forensics advanced investigative strategies pdf,mobile forensics pdf,registry npm,android operating system for pc,volatility meaning,lime juice,phone number search,android forensics course,digital forensics salary,volatility index,android operating system for laptop,digital forensics process,ntfs to fat32 converter,phone wallpapers,registry error,volatility tutorial,file systems pdf,digital forensics definition,android forensics book,android forensics software,mobile car wash,phonetic alphabet,computer forensics books,@file systems for discovery,mobile forensics – advanced investigative strategies,volatility adjustment solvency ii,computer forensics salary,file systems supported by mac,volatility adjustment formula,android forensics open source,android forensics dd image,android forensics investigation analysis and mobile security for google,mobile forensics free tools,registry log.reg,file systems in unix,computer forensics meaning,digital forensics with open source tools pdf,registry mechanic,mike wilkinson facebook,ntfs to fat32,mike wilkinson basketball,mobile al weather,volatility skew,mike wilkinson ufc,mobile forensics cellebrite,android forensics github,mobile forensics training online,computer forensics degree,ntfs dosya sistemi nedir,digital forensics corp,mike wilkinson aberystwyth,limestone,android operating system features,volatility formula,limerence,mobile dog grooming,computer forensics analyst,mike wilkinson nationwide,ntfs drive protection,digital forensics framework,volatility smile,mike wilkinson comedian,ntfs file system,ntfs nedir,registry collection,android operating system pdf free download,android operating system ppt,mobile forensics linux,ntfs hatası,phone repair,mike wilkinson linkedin,digital forensics tools,digital forensics certification,file systems comparison,mobile homes for rent,mobile pet grooming,lime green nails,mike wilkinson premier research,volatility indicator,android operating system versions list,android forensics apk,limeade,mike wilkinson lse,mobile forensics forum,mobile homes for rent near me,limelight,mobile forensics training,file systems in operating system,registry cleaner,mobile forensics cases,digital forensics software,mobile hotspot,volatility clustering,phone number,computer forensics fundamentals,limewire,android forensics tools,phone number lookup,ntfs for mac,phoneclaim,android forensics kali,mobile forensics open source tools,ntfs.sys,limerick,ntfs fat32 çevirme,mobile legends,registry docker,mobile forensics sans,android forensics pdf,computer forensics investigator,volatility convexity formula,registry repair,android forensics tools free,computer forensics course,mike wilkinson infovista,file systems types,mike wilkinson vs artem lobov,mobile mini,phone plans,mobile forensics challenges,phones for sale,ntfs for mac mojave,phone screen repair,ntfs ne demek,registry windows,android forensics tools open source,lime rock park,mike wilkinson photography,registry editor,phone tracker,phonearena,registry windows 10,mobile forensics software,ntfs-3g,android operating system definition,mobile homes for sale near me,mobile forensics tools,ntfs mi exfat mı,computer forensics and cyber security,registry cleaner free,registry office,phone repair near me,mobile forensics tools and techniques,mobile detailing,file systems used in linux,lyme disease,file systems explained,mobile al,phone validator,android operating system distribution,mobile forensics cookbook,mobile mechanic,registry reviver,android operating system names in order,mike wilkinson ashtead,file systems book,volatility surface,digital forensics course,android operating system update,phone cases,phone lookup,computer forensics services,computer forensics jobs,limelife,android operating system architecture,phone store near me,registry viewer,limerock,android forensics book pdf,computer forensics abstract,computer forensics tutorial,android forensics tutorial,digital forensics sans,ntfs for mac full,volatility trading,file systems supported by windows,mike wilkinson wisconsin,android forensics kali linux,lime lush,android forensics without root,file systems in linux,computer forensics process,computer forensics hardware tools,android operating system download,volatility adjustment eiopa,digital forensics training,volatility adjustment,digital forensics degree,volatility forensics,registry traduccion,mike wilkinson bechtel,digital forensics ppt,ntfs indir,registry life,computer forensics tools,registry club reclamos,digital forensics framework descargar,mike wilkinson vs makwan amirkhani,file systems definition,computer forensics in india,ntfs for mac free,ntfs biçimlendirme,file systems structures and algorithms pdf,volatility stop,ntfs format,android operating system for pc free download,ntfs fat32 farkı,volatility adjustment definizione,android (operating system) – unabridged guide,lime green,digital forensics jobs,ntfs system file,android forensics image,digital forensics magazine,phone interview questions,phonetic,file systems list,mike wilkinson mma,phone booth,lime crime,mobile suit gundam,digital forensics with kali linux pdf,android operating system names,file systems in windows,registry club,mobile passport,mobile homes for sale,mike wilkinson instagram,limelight nyc,computer forensics ppt,mike wilkinson photographer,