Скачать или смотреть Forensic Analysis of TAILs

Does Slicing Onions Make You Cry - Forensic Analysis of TAILs

🎙️ Aaron Sparling, Principal Incident Response Engineer, Walmart - Cyber Security Incident Response
📍 Presented at SANS DFIR Summit 2025

Adversaries leverage the TAILs (The Amnesic Incognito Live System) operating system for conducting criminal activity.

This presentation will address forensic imaging and analysis issues and illustrate techniques which can be used to access and analyze the much needed data. TAILs runs within the physical memory (RAM) of the host system, which if imaged and analyzed can provide numerous valuable forensic artifacts. This talk will address issued faced when confronted with systems running TAILs, options for imaging the TAILs instance and methods which can be applied to locate artifacts of interest for forensic analysis.

View upcoming Summits: https://www.sans.org/u/DuS