SecDocs Feed for author Matthieu Suiche

[Paper] Blue Screen Of the Death is dead

Wed, 28 Sep 2011 19:39:16 +0200

Authors: Matthieu Suiche
Tags: forensic
Event: Black Hat USA 2010
Abstract: This talk is introducing MoonSols Windows Memory Toolkit aims at being the ultimate memory and crash dump acquisition and conversion tool for Windows. Including live acquisition on Windows of Microsoft crash dumps, the conversion of hibernation file into crashdump, and even to get a crashdump of a running VMWare Virtual Machine without rebooting it and without any BSOD!

[Slides] Blue Screen Of the Death is dead

Tue, 27 Sep 2011 20:52:23 +0200

[Video] Windows Hibernation File for Fun and Profit

Thu, 05 Aug 2010 16:18:00 +0200

Authors: Matthieu Suiche
Tags: forensic Windows
Event: Black Hat USA 2008

[Audio] Windows Hibernation File for Fun and Profit

Thu, 05 Aug 2010 11:10:00 +0200

Authors: Matthieu Suiche
Tags: forensic Windows
Event: Black Hat USA 2008

[Slides] Windows Hibernation File for Fun and Profit

Thu, 05 Aug 2010 11:10:00 +0200

Authors: Matthieu Suiche
Tags: forensic Windows
Event: Black Hat USA 2008

[Paper] Advanced Mac OS X Physical Memory Analysis

Mon, 24 May 2010 06:02:53 +0200

Authors: Matthieu Suiche
Tags: forensic Mac OS X
Event: Black Hat DC 2010
Abstract: In 2008 and 2009, companies and governments interests for Microsoft Windows physical memory growled significantly. Now it is time to talk about Mac OS X. This talk will describe basis of Mac OS X Kernel Internals (and not a XNU kernel creation timeline) and how to retrieve various information like machine information, mounted file systems, processes listing and extraction and threads, kernel extensions listing and extraction and Rootkit detection.

[Slides] Advanced Mac OS X Physical Memory Analysis

Mon, 24 May 2010 06:02:50 +0200