Physical Memory Analysis Fundamentals

This is a revised version of the seminar delivered more than 2 years ago. Now updated to the latest WinDbg from Windows SDK 8.1.

Topics include:

  • User vs. kernel vs. physical memory space
  • Challenges of physical memory analysis
  • Common WinDbg commands
  • Patterns and pattern catalogues
  • Common mistakes
  • Fibre bundles
  • Hands-on exercise: a physical memory dump analysis
  • A guide to Software Diagnostics Library
  • Memory forensics

Physical Memory Analysis Logo

Date: December 30, 2013
Time: 7:00 PM (GMT)
Duration: 60 minutes