Forensics Skillset: Techniques for Extraction and Analysis of the Evidence
summary
Shows step-by-step extraction from live memory and disk: locate injected code in rundll32 and msiexec, dump RAM with Volatility, find MZ headers and extract DLLs, repair corrupted EVTX with CQEVTXRecovery, and pull Chrome DPAPI secrets using mimikatz/CQTools after importing a leaked AD certificate; demonstrates hiding a service via sc sdset SDDL, hunting persistence with Autoruns and USN Journal, and real incidents — retail ransomware across thousands of stores, 200+ day dwell times, 42 domain admins, a €500k failed decryptor — all tools and fixes shown and validated.
AI-written summary · about
chapters (7)
- 0:00Introduction and context
- 2:47Incident response insights
- 11:19Memory analysis techniques
- 19:59Evidence extraction methods
- 27:17Persistence and services
- 33:31Disk forensics and journals
- 41:19Credential and secret analysis
related talks
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
52mAdventures in Underland: Hacker Tricks to Stay Under the...
53mForensic Investigations of Web Exploitations
01h 03mInvestigating Malware Using Memory Forensics - A Practical Approach
33mBasic Malware Analysis for Incident Responders
14mDFIR - Don't Forget Your Roots!
46mDigital Forensics – The Importance of Forensic Triage Images