I have a memory dump. I know it is infected by a rootkit which uses its own file system installed at the end of the disk. Can there be any artifacts in dmp file to show this?
I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...