This book is one of the best book i have read in recent years. This is a book for anyone in the field of Incident Response, Malware Analysis, Reverse Engineering and Digital Forensics. This book is written by the Core Developers of Volatility and pioneers in the field of memory forensics.The book is very well structured it covers the internals of the Operating System and then the authors explain how the structures are used by the plugins, the authors also show how these plugins can be run against the memory images with real case examples to identify forensic artifacts. In many cases the authors show how to access the operating system structures programmatically using the volshell, this can help in writing your own plugins and also the author references various external sources where you can find more information on a specific topic. The book covers many creative techniques that you can apply in the real world and it also covers information on the Anti-Forensics techniques and how to detect them by cross referencing them with different plugins/data sources. The amount of detail explained in the book shows the knowledge and amount of research the authors have done in this field and the effort the authors have put in to write this book and the Volatility plugins. In short After reading this book you will understand how the operating system works, how the Volatility works, how malware works, how memory forensics work, how to identify the malware and forensic artifacts using memory forensics, how to write your own plugin. I have never seen any book covering these many details, this is one book for everything on memory forensics. This definitely should be the Book of the Year. If there was an option of giving this book ten stars, i would give it ten stars.

At this writing (Fall 2014) the Wiley instructor companion website is not up to Wiley standards (yet). I wanted to test the code for this review, but the code section on the site only defaults to the creative commons license (both the code and license links). Same with all the chapters, they only display commons, a strawman syllabus and an intro letter. They only resource that is already up is the Powerpoint presentation, and at over 100 pages it is simply OUTSTANDING, which whets the appetite even more for the rest of the outlines, solutions, code, and much more.

So, Wiley, get with it! If you are considering buying this, add your vote in comments and Wiley might listen. I'll update this once we get the code, both with quality of the code and where it can be used. Going over the license so far, it is quite generous, much like GNU with an attribution link, although of course more robust beyond teaching (eg commercial) if you do get permission. The text itself has wonderful, up to date sploit and software info, patches, etc. but the site, for a book this costly, needs to be completed. I'm not recommending you pass on this because of it, but we won't be getting the full value for our purchase, nor will our students, until the site is completed.

REVIEW UPDATE: SEE MICHAEL'S COMMENT ATTACHED TO THIS REVIEW. Although Amazon's automated system generally removes links, the comment gives complete and up to date online resources for this book, as the publisher's link is incomplete, and will not be updated. The publisher promotion of online evidence samples, code, etc. is not wrong or deceptive, it is just on github rather than the publisher's site as indicated. PLEASE VIEW THE COMMENT AND VISIT THE SITES INDICATED IN THE COMMENT BEFORE LEAVING A NEGATIVE REVIEW-- the resources ARE there, just not where advertised. Also, see Michael's other best seller at: Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code.

If you are price conscious, notice that in addition to the generous web resources in the comment (including open source/ freeware), the book is over 900 pages long, and PACKED with practical, use-it-now reference and learning tools. I've already visited the samples, and they are awesome, especially given that they cover the most frequent o/s permutations. Both Windows and Linux give the exact traces indicated, these authors are the real thing.

i found most of the necessary info im looking for

I have worked in I.T. for 15 years - in Windows system administration, database administration, and utility software development. About one month ago I started reading heavily on security, and planned for 2015 a shift in career focus to that discipline. So I bought this book and began to read. This had immediate payoff just 2 days ago when I noticed an email from our security team that an IDS had detected a possible Trojan signature on one of our servers. Another analyst ran a full AV scan, and when she found nothing, the email thread dried up. Not so convinced (I had just read the fact on Mandiant's website that "100% of victims had up-to-date AV software), I triggered a complete memory dump on the server using LiveKD and began working on it with WinDbg commands and Volatility Framework. Within the first few hours, it appeared that there certainly looked to be a rootkit-like presence, but with my limited security knowledge and, even though I debug a kernel dump every now and then, I don't usually look at things like the IDT 2e entry, etc. However, 15 hours into researching my first real-life production issue, I completely narrowed down the source and contacted the security team and account management. This server would have continued to operate under the radar with the standard tools continually missing the malware's presence and caused who knows what problems. Thanks to one of the most well-organized, well-written, and informative I.T. books I have ever read, I was able to effectively isolate this piece of malware. This book is an absolute must for anyone even employed in I.T. with responsibilities over safeguarding company networks and infrastructure, and (unfortunately) these days, should probably be employed by anyone at all that plugs in an Ethernet cable or attaches to Wi-Fi! Outstanding material - thanks very much.

AMF is a volume of stuff you just have to know, or at least you have to know where to find it. The book is an essential reference, reasonably complete and well written. It reminds me of the classic Morse and Feshbach "Methods of Mathematical Physics". Like M&F, its contents must be ingested in small chunks when needed. It isn't a textbook entitled the principles of memory forensics.

It's not a comprehensive handbook like Morse and Feshbach. But the current empirical field of memory forensics is not amenable to the kind of structural analysis that can be taught to graduate level physics students. My reason for not rating it five stars is the lack of a theoretical backbone. This is not a computer science book. This is a book about the volatility framework with application to the structure and function of computer memory. It is not a book about data structures or processes. It isn't really forensics, which is the presentation of scientific data and analysis in a court of law.

If you buy the book as a practical handbook of memory forensics, as its authors say, "Art"; you will be pleased. It is a "What do I do now that I have downloaded and typed 'python vol.py.'" I don't know of a better book,

I wish I had purchased this a lot sooner than I did. Although the SANS FOR 508 course was a great course, this book goes even further in detail regarding not just how to use Volatility and its plugins, but more importantly WHY you use certain plugins and HOW the plugins work based on how malware works. Very thorough explanations, it makes thing a lot more clearer now. Its like a lightbulb went off and I'm only half-way through the book. Well worth the price. A must for any serious forensics analyst who wants to stand out amongst his/her peers.

The Art of Memory Forensics (AOMF) is a ground-breaking technical resource (800+ pages) that is critical to everyone who currently works in Information Security or aspires to. I leverage this book almost daily as a digital forensics and incident response practitioner. It allows analysts better understand multiple OS (Windows/OSX/Linux) data and memory structures and how forensic tools can used and be written to parse them. AOMF also starts at a lower level than memory, defining Intel (IA) and related hardware architecture before building up to data types and structures found in memory.

AOMF has over 450 pages dedicated to Windows forensic analysis. While there is a primary focus memory, the authors do a fantastic job of explaining technical analysis concepts around critical areas including the Windows Registry, Event logs, Services, Networking, timelining, kernel level artifacts and much more.

AOMF also covers Linux and OSX, which are two OS’s that are utilized more frequently and require deep-dive analysis today. The memory analysis chapters in these sections provide a solid resource for those interested in understanding more about investigating the bowels of what goes on behind the scenes with regards to unique Linux and OSX files, filesystems, processes, networking and unique userland/kernel artifacts for starters.

Finally, AOMF serves as a verbose educational resource for both professors and students. This is the primary/sole resource I will be leveraging, using labs from and referencing as a graduate level memory forensics professor starting next month.

The Art of Memory Forensics is one of the best written and edited tech books I have read. It covers a very technical subject at a level that those new to the subject can understand while providing enough detail to deeply engage advanced practitioners. The authors took pains to include a variety of real world examples demonstrating even the most esoteric concepts. Every security professional should have this on their shelf!

If you do any kind of forensics, you need memory forensics. And this book is the current bible for it. I have learned more from this book than any other in digital security.

The Art of Memory Forensics is like the equivalent of the bible in Memory Forensic terms. It is a must have and a must have if you are actively involved in computer forensic investigations whether this be in the private or public sector. Do not be intimidated by the size of the book it is very well laid out , easy t understand and contains a treasure trove of information concerning the examination of memory. The main tool used is Volatility which this book explains in detail how to use and leverage in investigations to get the most evidence.

Il libro si presenta bene molto dettagliato nei vari processi e spiegazioni molto tecnico

Parece ser muito bom; foi indicado por um especialista na área

Un très bon livre, mais pour bien l’apprécier, il faudra malgré tout avoir une bonne base technique