LinuxCheck– this is a small bash script to collect information, useful for emergency response on Debian and Centos systems. Characteristics: LinuxCheck– this is a separate script, capable of collecting a large set of information: CPU TOP10, memory TOP10 CPU usage boot time Hard disk information User information, information about passwd Read More …
Category: Information security
Advertisements
How to extract forensic artifacts from pagefile.sys?
Microsoft Windows uses page file (pagefile.sys), for storing memory blocks, which do not currently fit into physical memory. This file, is stored at %SystemDrive%pagefile.sys and is a hidden system file and cannot be read or accessed by the user, including Administrator on active system. This file Read More …
Analyzing compressed memory in Windows 10
Memory analysis in Windows 10 very different from previous versions of Windows: new feature, called memory compression, makes a forensic tool necessary, capable of reading compressed memory pages. Memory compression in Windows 10 Latest Windows Releases 10 enable memory compression function, which Read More …
Amcache and Shimcache in forensic analysis
Data from Amcache and Shimcache can provide a timeline of whether, what program was executed, when it was first launched and last modified.
Forensic Artifacts: proof of program execution on Windows systems
During forensic analysis of a Windows system, it is often important to understand, when and how a specific process was started.