收集一些取证的小知识
取证工具
[转载-收集]
取证工具: https://github.com/volatilityfoundation/volatility https://www.mandiant.com/resources/download/redline http://cert.at/downloads/software/densityscout_en.html http://rjhansen.github.io/nsrllookup/ https://github.com/dkovar/anal https://www.e-fense.com/store/index.php?_a=viewProd&productId=14 http://www.volatilityfoundation.org/#!24/c12wa https://github.com/sleuthkit/sleuthkit/tree/develop/man
一些文档
[转载-收集]
文档: http://www.freebuf.com/articles/system/26763.html http://drops.wooyun.org/papers/2854 http://www.forensicswiki.org/wiki/Tools%3aMemory_Imaging#Linux http://technet.microsoft.com/en-us/sysinternals/bb897441.aspx http://betanews.com/2013/10/28/check-unsigned-files-at-virustotal-with-sysinternals-sigcheck/ http://staff.washington.edu/dittrich/misc/forensics/
1.Linux下dump(dd命令)内存不成功?
Linux Kernel 2.6.x某个版本后开始对内存访问做了保护,无法dump出完整内存.可使用第三方工具Lime / fmem等来dump内存.