BSIDES Vancouver 2013 presentation on Volatility iPython Notebooks

Here are a collection of interactive workbooks from BSIDES Vancouver 2013 talk on Volatility 3.0TP2 and memory forensics. They consist of a collection of iPython Notebooks sitting on a Backtrack5 VM. All Volatility packages were manually updated. They go really well together with the Volatility Cheat sheet for learning and review.

Intro

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/01-presentation-ME.ipynb

Toy example of how to scan memory dumps

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/02-parsing_memdumps_ipaddress.ipynb

Memory Forensics Using Volatility

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/03-presentation-intro.ipynb

Memory Forensics of Silent Banker Trojan

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/04-presentation-SBtrojan.ipynb

Potential Data Visualization reports for forensics

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/05-TimeSeriesReview.ipynb

Learning resources

• http://nbviewer.ipython.org/urls/raw.github.com/bigsnarfdude/bsides_vancouver_2013/master/06-next_Steps.ipynb

Volatility Cheat sheet

https://blogs.sans.org/computer-forensics/files/2012/04/Memory-Forensics-Cheat-Sheet-v1.pdf