The inspector: automating the forensic investigation of infected computers

John Morris, Eric Kedrosky Nortel

  download slides (PDF)

Zero day outbreaks of bots and viruses, undetected by current AV signatures, are common occurrences on corporate networks. When dealing with a significant outbreak of a new threat, there are many unknowns, not the least of which are knowing what common vulnerabilities may be allowing these systems to become infected and the malware files that have been deposited. By automating the forensic investigation process, IT security teams can be provided this critical information within minutes of the outbreak starting.

This presentation will cover why automated forensic investigations are needed, what information to gather and how to gather it remotely.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.