1. Forensic Analysis : using TSK and Volatility

2. A bit about Me Mark Bennett Work for Check Point Software.
Incident Response/Forensics for Health Care
Firewalls
Malware analysis
Intrusion Prevention
HR/Legal
Watching over the enterprise
SANS Instructor

3. Agenda Metasploit How to use it What can you do with it
Making Forensic copies
Copying memory
Copy Hard drive
Timeline analysis
How to create
How to read
Memory analysis
Strings
Volatility
See it live
Wrap up

5. Metasploit

6. Metasploit – cont.

7. Mandiant Memoryze

8. Using dd for bit-by-bit copies

9. fls - bodyfile

10. mactime - timeline

11. Timeline Analysis

12. Memory Analysis

13. Volatility – memory analysis

14. Live Demo
Let’s Do it for Real!!!

15. Questions/Comments
??????????????????????????????????

16. Wrap UP
Mark Bennett
508 Advanced Forensic Analysis
408 Windows Forensics
504 Incident Response
Hack Labs – Metasploit
Be good, be safe, if you are going to hack, hack legally and responsibly – I’m Out!

17. THANK YOU FOR ATTENDING