Section 2: Windows Forensic Analysis
This section will take you through the Windows memory acquisition process and memory dump analysis, including recovering user actions and hunting malicious activity in memory.
This section of the book comprises the following chapters:
- Chapter 3, Windows Memory Acquisition
- Chapter 4, Reconstructing User Activity with Windows Memory Forensics
- Chapter 5, Malware Detection and Analysis with Windows Memory Forensics
- Chapter 6, Alternative Sources of Volatile Memory