Labs / Capstone investigations
From a memory image to a file on disk
Find the odd process in a memory image, follow its command line to a file in the disk image, hash it, and confirm it with a YARA rule. Volatility, sha256sum, and yara, in that order.
Briefing
A laptop was captured live, both RAM and disk, after the proxy flagged traffic to 192.0.2.150. The disk image is mounted read-only under cases/lt-chen/disk/.
Memory tells you what was running and where it was loaded from. The disk tells you whether that file is still there and what it is.
forensics-ws · Capstone investigations
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.