Skip to content
All modules
AdvancedModule 13 of 15120 minutes

Memory and disk forensics

Answer the three questions a memory image is asked - what was running, what was typed, what was on disk - and know why a scan beats a list.

By the end you can

  • Distinguish a raw memory image from a crash dump or hibernation file before analysing it
  • Explain why psscan finds processes pslist cannot, and what that costs in validation
  • Recover command lines from a Windows image, including the UTF-16 problem
  • Locate and carve a registry hive out of a dump and read persistence from it
  • Read ext, FAT and NTFS structures well enough to recover a deleted or resident file

1. Read

2. Use the tools

In the order they come up while solving. Each opens the workspace tab that runs it.

3. Try one now

Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.

4. Practise on the real thing

Real picoCTF challenges that use these techniques, easiest first. 26 match in total - see the full index.

Checkpoint

Given a raw Windows memory image, produce the process tree, identify the process that should not be there, and recover the command line it was started with.

Teaching note

The UTF-16 point lands better as a demonstration than as a statement: run strings without -el on a dump, get nothing, run it with -el, and get the whole command history. Students who see that once never forget it.