Practical Memory Forensics by Svetlana Ostrovskaya & Oleg Skulkin

Practical Memory Forensics by Svetlana Ostrovskaya & Oleg Skulkin

Author:Svetlana Ostrovskaya & Oleg Skulkin
Language: eng
Format: epub
Publisher: Packt
Published: 2022-12-15T00:00:00+00:00


As you have already noticed, there are various types of timelines. We will talk about those that can be built using memory dumps.

Filesystem-based timelines

This timeline is based on filesystem metafiles. For NTFS, this file would be, for example, the Master File Table ($MFT). This file contains information about all files of the filesystem and their timestamps.

To build a timeline based on $MFT, first, we need to get its data. This can be done with the Volatility mftparser plugin, which collects all $MFT entries from memory. Running this plugin will look like this:



Download



Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.